Yes that would work.   To build on @BlakeRichardson's response, you could create a DMZ behind the MX.  Create a firewall rule so it can not talk to the internal network, and then just NAT one of the static IP addresses through to it.   Or - host it in a public cloud provider like Amazon AWS. ... View more

Yes, you can use a flow preference for this. However, you cannot use FQDN's for the destination. It needs to be either an IP or subnet in CIDR notation. Also, in your example, the source port is unlikely to be 25. It will most likely be an ephemeral port number and therefore you're better off leaving it as Any.   More info at link below. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Load_Balancing_and_Flow_Preferences#Flow_Preferences     ... View more