Junos OS

Expand all | Collapse all

How to block smtp port for internal subnet with firewall filter

Jump to Best Answer
  • 1.  How to block smtp port for internal subnet with firewall filter

    Posted 10-24-2018 10:11

    The goal i'm trying to accomplish is that for the mail server to be the only machine sending out mail on the network so ihave been looking into setting up a firewall filter to block everyone on the subnet except for ail server but the failer is stressful bcoz it once i commit the changes the firewall port locks up......



  • 2.  RE: How to block smtp port for internal subnet with firewall filter

     
    Posted 10-24-2018 17:16

    I assume you are looking for a stateless firewall filter and not an SRX security policy.

     

    This would be the filter.

    set firewall family inet filter RestrictSMTP term AllowSMTP from source-address 192.168.1.1/32
    set firewall family inet filter RestrictSMTP term AllowSMTP from protocol tcp
    set firewall family inet filter RestrictSMTP term AllowSMTP from destination-port smtp
    set firewall family inet filter RestrictSMTP term AllowSMTP then accept
    set firewall family inet filter RestrictSMTP term BlockSMTP from protocol tcp
    set firewall family inet filter RestrictSMTP term BlockSMTP from destination-port smtp
    set firewall family inet filter RestrictSMTP term BlockSMTP then discard
    set firewall family inet filter RestrictSMTP term AcceptOther then accept

     

    you would then apply this to the input of the interface where the subnet enters the switch.

    set interfaces ge-0/0/0 unit 0 family inet filter input RestrictSMTP

     



  • 3.  RE: How to block smtp port for internal subnet with firewall filter
    Best Answer

    Posted 10-25-2018 11:53

     

    [edit]
    root@STONEGUARD# commit
    [edit firewall family inet filter smtpfilter1 term smtpterm1 from source-address]
    '172.168.1.254/24'
    '172.168.1.254/24' has non-zero bits where bits in mask are zero
    error: configuration check-out failed

    [edit]
    root@STONEGUARD#

     

     

     

     

     

    This error is persistant and thanks for match-conditions example but i am still in the cold water it seems 



  • 4.  RE: How to block smtp port for internal subnet with firewall filter

     
    Posted 10-26-2018 05:36

    If you want to block a network then I'm not too sure the following will do it for you:

     

    You seem to have configured as a source-address:

    172.168.1.254/24

     

    It won't like that as that is not a /24 prefix. For a complete network in the filter use:

     

    172.168.1.0/24

     

    or for that particular host:

     

    172.168.1.254/32

     

    It should like either of those options.



  • 5.  RE: How to block smtp port for internal subnet with firewall filter

    Posted 10-26-2018 07:28

    Thanks! to you guys so much on the codes and the corrections on the /24 prefix error so now the mail server only can send out on smtp port