How to block all outgoing port 25 except internal mail server.
*BSDThis forum is for the discussion of all BSD variants.
FreeBSD, OpenBSD, NetBSD, etc.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
How to block all outgoing port 25 except internal mail server.
Our ISP setup and installed an OpenBSD Firewall at the border doing NAT translation. I知 running a linux mailserver internally. It seems about every six months someone brings an infected laptop into the building that starts sending out spam and gets us blacklisted. I知 looking for something that will block all outgoing port 25 except for the mail server. Notification (email or ?) would be a big bonus.
I have been playing around with
pass out quick on $ext_if proto tcp from $emailserver to any port 25 flags S/SA synproxy state
block out on $ext_if proto tcp from any to any port 25
however everytime I run that rule the email server returns "no route to host" when I try to ping outside servers.
I知 fairly new to the OpenBsd world so any suggestions on an overall monitoring or logging that could be setup on the firewall would be great also.
Thank you
Randy
Something like this from the cisco world.
access-list acl_out permit tcp host X.X.X.X any eq 25
access-list acl_out deny tcp any any eq 25
access-list acl_out permit ip any any
Could you give me an explanation of that command? I am fairly new to OpenBSD and Linux/UNIX in general. From my research I have found iptables apply to linux. I am using OpenBSD and not sure where that is implemented.
Our ISP setup and installed an OpenBSD Firewall at the border doing NAT translation. I’m running a linux mailserver internally. It seems about every six months someone brings an infected laptop into the building that starts sending out spam and gets us blacklisted. I’m looking for something that will block all outgoing port 25 except for the mail server. Notification (email or ?) would be a big bonus.
I have been playing around with
pass out quick on $ext_if proto tcp from $emailserver to any port 25 flags S/SA synproxy state
block out on $ext_if proto tcp from any to any port 25
however everytime I run that rule the email server returns "no route to host" when I try to ping outside servers.
What I would do is block on the internal interface, as follows:
Code:
## macros
int_if = "192.168.1.100/32"
lan = "192.168.1.0/24"
mail_ports = { 25 465 587 }
mail_server = "192.168.1.50/32"
## filtering - block traffic on all interfaces
block log all
## let traffic out on all interfaces
pass out keep state
## block in all traffic on internal interface
## destined for mail ports
block in on $int_if from $lan to any port $mail_ports
## pass in traffic on internal interface from mail server
## destined for mail ports
pass in on $int_if from $mail_server to any port $mail_ports
## pass all other traffic coming in on
## internal interface
pass in on $int_if from $lan to any
Last edited by Gerard Lally; 04-14-2011 at 11:02 AM.
For some reason I cannot even get the block to work on the $int_if. I can get it to work on the $ext_if I'm just beating my head going in circles trying to figure this out. Attached is my pf.conf
Have any recommendations?
# $OpenBSD: pf.conf,v 1.34 2007/02/24 19:30:59 millert Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
#rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $int_if proto tcp from $int_if:network to any port 21 -> \
127.0.0.1 port 8021
#no rdr on $ext_if proto tcp from <spamd-white> to any port smtp
#rdr pass on $ext_if proto tcp from any to any port smtp \
# -> 127.0.0.1 port spamd
rdr on $ext_if proto tcp from any to $ext_if port \
$email -> $emailserver
rdr on $ext_if proto tcp from any to $ext_if port \
587 -> $emailserver port smtp
rdr on $ext_if proto tcp from any to $ext_if port \
smtp -> $spamfirewall
rdr on $ext_if proto tcp from any to $ext_if port \
8080 -> $spamfirewall port 80
rdr on $ext_if proto udp from any to $ext_if port \
500 -> $automation
rdr on $ext_if proto tcp from any to $ext_if port \
1723 -> $remoteaccess
rdr on $ext_if proto tcp from any to $ext_if port \
1792 -> $remoteaccess
rdr on $ext_if proto udp from any to $ext_if port \
1701 -> $remoteaccess
rdr on $ext_if proto udp from any to $ext_if port \
6502 -> $automation
rdr on $ext_if proto tcp from any to $ext_if port \
ftp -> $ftpserver
anchor "ftp-proxy/*"
block in
pass out
pass quick on $int_if no state
antispoof quick for { lo $int_if }
pass in quick inet proto icmp from any to any keep state queue icmp
pass out inet proto icmp from any to any keep state queue icmp
pass in quick on $ext_if inet proto esp from any to $ext_if:0 keep state
pass out quick on $ext_if inet proto esp from $ext_if:0 to any keep state
pass in on $ext_if proto tcp to ($ext_if) port ssh
pass in quick on $ext_if proto udp from any to $ext_if:0 port isakmp
pass out quick on $ext_if proto udp from $ext_if:0 to any port isakmp
pass in on $ext_if proto tcp from any to $emailserver port $email \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $emailserver port 587 \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $emailserver port smtp \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $spamfirewall port smtp \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $spamfirewall port http \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $remoteaccess port 1723 \
flags S/SA synproxy state
pass in on $ext_if proto udp from any to $remoteaccess port 1701 \
keep state
pass in on $ext_if proto tcp from any to $remoteaccess port 1792 \
flags S/SA synproxy state
# VPN GRE PROTOCALL
pass in proto gre all keep state
pass out proto gre all keep state
#
pass in on $ext_if proto udp from any to $remoteaccess port 500 \
keep state
pass in on $ext_if proto udp from any to $automation port 6502 \
keep state
pass in on $ext_if proto tcp from any to $ftpserver port ftp \
flags S/SA synproxy state
For some reason I cannot even get the block to work on the $int_if. I can get it to work on the $ext_if I'm just beating my head going in circles trying to figure this out. Attached is my pf.conf
Have any recommendations?
# $OpenBSD: pf.conf,v 1.34 2007/02/24 19:30:59 millert Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
#rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $int_if proto tcp from $int_if:network to any port 21 -> \
127.0.0.1 port 8021
#no rdr on $ext_if proto tcp from <spamd-white> to any port smtp
#rdr pass on $ext_if proto tcp from any to any port smtp \
# -> 127.0.0.1 port spamd
rdr on $ext_if proto tcp from any to $ext_if port \
$email -> $emailserver
rdr on $ext_if proto tcp from any to $ext_if port \
587 -> $emailserver port smtp
rdr on $ext_if proto tcp from any to $ext_if port \
smtp -> $spamfirewall
rdr on $ext_if proto tcp from any to $ext_if port \
8080 -> $spamfirewall port 80
rdr on $ext_if proto udp from any to $ext_if port \
500 -> $automation
rdr on $ext_if proto tcp from any to $ext_if port \
1723 -> $remoteaccess
rdr on $ext_if proto tcp from any to $ext_if port \
1792 -> $remoteaccess
rdr on $ext_if proto udp from any to $ext_if port \
1701 -> $remoteaccess
rdr on $ext_if proto udp from any to $ext_if port \
6502 -> $automation
rdr on $ext_if proto tcp from any to $ext_if port \
ftp -> $ftpserver
anchor "ftp-proxy/*"
block in
pass out
pass quick on $int_if no state
antispoof quick for { lo $int_if }
pass in quick inet proto icmp from any to any keep state queue icmp
pass out inet proto icmp from any to any keep state queue icmp
pass in quick on $ext_if inet proto esp from any to $ext_if:0 keep state
pass out quick on $ext_if inet proto esp from $ext_if:0 to any keep state
pass in on $ext_if proto tcp to ($ext_if) port ssh
pass in quick on $ext_if proto udp from any to $ext_if:0 port isakmp
pass out quick on $ext_if proto udp from $ext_if:0 to any port isakmp
pass in on $ext_if proto tcp from any to $emailserver port $email \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $emailserver port 587 \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $emailserver port smtp \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $spamfirewall port smtp \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $spamfirewall port http \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $remoteaccess port 1723 \
flags S/SA synproxy state
pass in on $ext_if proto udp from any to $remoteaccess port 1701 \
keep state
pass in on $ext_if proto tcp from any to $remoteaccess port 1792 \
flags S/SA synproxy state
# VPN GRE PROTOCALL
pass in proto gre all keep state
pass out proto gre all keep state
#
pass in on $ext_if proto udp from any to $remoteaccess port 500 \
keep state
pass in on $ext_if proto udp from any to $automation port 6502 \
keep state
pass in on $ext_if proto tcp from any to $ftpserver port ftp \
flags S/SA synproxy state
You can't get block to work on $int_if because you're using a "pass quick" rule which means none of the rules following the "pass quick" rule are applied:
Code:
pass quick on $int_if no state
Rules relating to $int_if after this simply aren't processed.
My advice is remove all "quick" keywords and let pf process your rules top to bottom, last matching rule wins. If I get a chance I'll tidy your ruleset although I'm by no means an expert at this either but it's better for you to go through it yourself first.
Last edited by Gerard Lally; 04-14-2011 at 06:27 PM.
This is AWSOME! Thank you very much. This is exactly how I learn the best. The config I listed is how my ISP set it up. This will be my first change that I’m making to it and I appreciate all your input. I have removed all the quicks for testing and still cannot get the block to work on the int_if I’m scratching my head at the moment.
I should note this firewall is also doing a branch office vpn connection to another office of ours.
This is AWSOME! Thank you very much. This is exactly how I learn the best. The config I listed is how my ISP set it up. This will be my first change that I知 making to it and I appreciate all your input. I have removed all the quicks for testing and still cannot get the block to work on the int_if I知 scratching my head at the moment.
I should note this firewall is also doing a branch office vpn connection to another office of ours.
I've just spotted the reason blocking on $int_if doesn't work: your ISP in their wisdom set up your pf ruleset to skip the internal interface, and enc0 as well, which I suspect is the VPN interface. Skipping on enc0 should be fine (it is a trusted VPN after all) but not on $int_if.
Remove $int_if from your "set skip on ... " rule. Flush your ruleset and restart firewall:
Code:
pfctl -F rules
pfctl -d
pfctl -e
Then your firewall will process rules on the internal interface.
Thank you VERY MUCH! I started going through the rules one by one so I had a full understanding of what was going on and caught that. Just wasn't sure how it should be handled. More playing I have to do
Welcome to LQ. Hope your time here helps you as much as mine has helped me.
Please put code, command line output, config files, etc. inside [CODE] tags, aka "Code:" blocks.
It will make your posts easier to read, & that will get you more, faster, better answers. -- Help us help you.
BTW, You can edit your post(s) to do this retroactively.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
Thank you very much. This is exactly how I learn the best. The config I listed is how my ISP set it up. This will be my first change that I’m making to it and I appreciate all your input. I have removed all the quicks for testing and still cannot get the block to work on the int_if I’m scratching my head at the moment. 
