Koozali.org: home of the SME Server

Legacy Forums => General Discussion (Legacy) => Topic started by: webweave on August 15, 2005, 07:14:09 AM

Title: Restricting port 25 to only allow list of IP
Post by: webweave on August 15, 2005, 07:14:09 AM: Hi,

We have a subscription to a commercial spam filtering service and they are asking us to modify our server (SME 6.0.1) to only accept connections to port 25 from a list of IP numbers they have supplied.

I would prefer a method that works with the design philosophy of the SME. Has anyone made a template for doing this? I imagine this would also be useful for anyone who wants to ignore IPs or ranges of IPs from common spammers.

Thanks for considering my question.
Cheers, ':pint:'
Brian
Title: Re: Restricting port 25 to only allow list of IP
Post by: gordonr on August 16, 2005, 03:00:16 AM: Quote from: "webweave"

I would prefer a method that works with the design philosophy of the SME. Has anyone made a template for doing this? I imagine this would also be useful for anyone who wants to ignore IPs or ranges of IPs from common spammers.

See these threads for my updated e-smith-packetfilter which allows you to configure an AllowHosts property for services:

http://forums.contribs.org/index.php?topic=27855.msg115863#msg115863

http://forums.contribs.org/index.php?topic=27855.msg115863#msg115863

An even later version is included in 7.0alpha, in which you can also configure a DenyHosts list.
Title: Restricting port 25 to only allow list of IP
Post by: webweave on August 19, 2005, 10:06:37 PM: Isn't that nifty.

This is a bare nuckles, er I mean command line tool right?

I am going through iptables/howto/iptables-HOWTO.html This looks like the right place to start. Is there a better howto somewhere?

Do you think in ver. 7 this will migrate into the server-manager?

Thanks Gordon, always a pleasure.
Title: Restricting port 25 to only allow list of IP
Post by: gordonr on August 19, 2005, 10:20:34 PM: Quote from: "webweave"
Isn't that nifty.

This is a bare nuckles, er I mean command line tool right?

Yes, peril sensitive sunglasses are a required option.

Quote from: "webweave"
I am going through iptables/howto/iptables-HOWTO.html This looks like the right place to start. Is there a better howto somewhere?

There's lots of stuff on netfilter.org The generated rules in /etc/init.d/masq are worth looking at while you're working through the HOWTO to see how they go together.

Quote from: "webweave"
Do you think in ver. 7 this will migrate into the server-manager?

7.0beta1 is out, so no.

Someone is proposing a panel here:

http://forums.contribs.org/index.php?topic=28417.0

but I haven't seen the panel and don't know how it's being implemented. As I stated in that thread, if it works through the configuration database, it would be a good addition. If it directly manages iptables rules, it it likely to cause a conflict with service configuration.
Title: Restricting port 25 to only allow list of IP
Post by: kruhm on August 21, 2005, 02:46:48 PM: -mkdir /etc/e-smith/templates-custom/etc/tcprules/tcp.smtp/
-start a new file called 85customdeny with the following:

Code:
{
$OUT = "theipyouwanttoblock:deny";
$OUT .= "theiprangeyouwanttoblock:deny";
}

-rebuild the file with a: /sbin/e-smith/expand-template /etc/tcprules/tcp.smtp
-pickup the changes with a: /sbin/e-smith/signal-event email-update
Title: Restricting port 25 to only allow list of IP
Post by: webweave on August 21, 2005, 08:44:39 PM: Does this also work for allow?
I'm trying to block all ip except those from my upstream mail provider.

Thanks Kruhm, This looks nice and easy and will surive the backup.
Title: Restricting port 25 to only allow list of IP
Post by: gordonr on August 22, 2005, 07:18:14 AM: Quote from: "webweave"

Thanks Kruhm, This looks nice and easy and will surive the backup.

Note that it will not work in 7.0 as we no longer use tcprules/tcp.smtp since changing from tcpserver to ipsvd. The equivalent files are in the "peers" subdirectories of the individual services. My suggestion will work under 7.0 as well as earlier releases, as long as you update e-smith-packetfilter.