On May 12, at 11:56 AM, Tim Aslat wrote: > > I hope this isn't too off topic, but I'd like a quick solution to a > problem. > > I have a small network behind a NAT firewall (FreeBSD of course) and I'd > like to block/redirect all traffic from the internal network to the > local mail server (same box as firewall) in order to prevent direct smtp > requests to the outside world (mainly virus/trokan programs). Set up the mail server as the hub for your internal network, and have the workstations forward mail to it. If you're running sendmail on the workstations, put this in their .mc file: define(`SMART_HOST', `smtp:mailhub.privatedomain') And rebuild their sendmail.cf (I use the same .mc file for all U**X boxen on my network, except for the mail hub). Basically, just point all internal boxen's mailers to the hub. My mail hub, in turn, defines SMART_HOST to be my ISP's mail cluster, and I define MASQUERADE_AS to be my ISP's domain (I use the feature masquerade_envelope, too). You might not be able to do this, of course, it'll depend on your connectivity. You'll need an MX record set up for the mail hub in your DNS. > I think I have it right in this rule, but I would prefer to get a > second, or even a third opinion. > > ipfw add fwd 127.0.0.1,25 tcp from any to me dst-port 25 Given the above approach, the only thing I have in my firewall for SMTP is a rule for stateful outbound on ports 25 and 995 (I use SSL- enabled POP3 to download incoming mail from my ISP's mail cluster). Hope this helps, Dave -- ______________________ ______________________ \__________________ \ D. J. HAWKEY JR. / __________________/ \________________/\ [email protected] /\________________/ http://www.visi.com/~hawkeyd/ _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[email protected]"