need to deny any device local using port 25 except my email server

[FishMan]

need to deny any device locally from using port 25 except my email server

[ww]

Rule 1 . Allow serverIP + port25(src  or dst depending on your needs)

Rule 2   deny anyIP + port25(src or dst..)

Apply on the network device as close to the client as possible

[FishMan]

 Can you confirm that this is what you mean

thanks

[ww]

I guess its more like

Allow    Server ip, any, any, 25

Deny     Any,any,any, 25

[KarstenI]

The source port in an ACL typically has to be "any". Often you do not want to care about the source ports in use. Most systems use a random port > 1023 but some are also using ports < 1024. SMTP typically uses ports >1023.

[FishMan]

sorry i have this problem, when i apply deny any any with destination port 25 my email is on queue

when i remove any then i allow my email to move from queue

can someone help on this

[KarstenI]

For whatever reason, your allow rule does not work. Do you use TCP/25 to access the Mailserver? Test to change the port 25 to "Any" in your allow rule and see if it has hits.

[Bruce]

You need a slight change to your allow rule...

To allow your mail server outbound access you need the ‘mail server’ IP address in the source IP address for the allow rule, the source port is any, the destination IP address is any, and the destination port is 25. Your mail server will likely use a ‘random’ outbound/source port, but always its own IP address, the destination will always be ‘any’ (because you don’t know what it’s connecting to), and the destination port will always be TCP port 25, since that’s the well known port that SMTP listens on.

Thats should get you working.

[KarstenI]

Oh, yes, it's the mail-server that needs to send mails. I was under the impression that you want to only allow access *to* the Mail server. Of course Bruce is right here.