topic Re: Restrict Outbound Port 25 to one IP only in Network Security

Restrict Outbound Port 25 to one IP only

conrad2467 — Mon, 11 Mar 2019 21:40:14 GMT

Hi,

I want to restrict outgoing smtp traffic to our mail server only.

Mail server: 192.168.1.13

Router: Cisco 857W

I have implemented the following access-list but other pc's can still telnet to mail servers via port 25. Where have i gone wrong?

RouterID#show access-list
Extended IP access list 100
    10 permit tcp host 192.168.1.13 any eq smtp
    20 deny tcp 192.168.1.0 0.0.0.255 any eq smtp log
    30 permit ip 192.168.1.0 0.0.0.255 any
Extended IP access list NAT
    10 permit ip any any

RouterID#

Thanks

Restrict Outbound Port 25 to one IP only

Julio Carvajal — Thu, 20 Oct 2011 05:54:53 GMT

Hello Conrad,

With this configuration you should be able to access SMTP servers just from 192.168.1.13, if you

do a show access-list 100, how many hits do you see on line 2???

Can we see the access-group??

I will be waiting your answer,

Regards,

Julio

Restrict Outbound Port 25 to one IP only

conrad2467 — Thu, 20 Oct 2011 06:26:20 GMT

Julio,

I get the following if i do a show access-list 100. Im not sure what you mean by "how many hits..."

Extended IP access list 100
    10 permit tcp host 192.168.1.13 any eq smtp
    20 deny tcp 192.168.1.0 0.0.0.255 any eq smtp log
    30 permit ip 192.168.1.0 0.0.0.255 any

Restrict Outbound Port 25 to one IP only

cadet alain — Thu, 20 Oct 2011 08:05:03 GMT

Hi,

you should do this:

access-list 100 permit tcp any host 192.168.1.13 eq smtp

access-list 100 deny tcp any any eq smtp

access-list 100 permit ip any 192.168.1.0 0.0.0.255

then apply this ACL inbound on the inside interface

Note: sh access-list will give inparentheses the number of packets that matched this ACL, these are hits but you've got none here because your ACL is incorrect and maybe not applied in the good direction on the interface.

Regards.

Alain.

Re: Restrict Outbound Port 25 to one IP only

conrad2467 — Thu, 20 Oct 2011 09:17:29 GMT

Alain,

I have created the ACL as per your instruction. I have then applied the ACL to the BVI1 interface as follows.

RouterID(config)#interface BVI1
RouterID(config-if)#ip access-group 100 in

The instance i apply this acl, I lose connection to internet completely. Any ideas why this could be the case?

Thanks

Restrict Outbound Port 25 to one IP only

cadet alain — Thu, 20 Oct 2011 13:31:47 GMT

Hi,

yep sorry then in this case do this:

ip access-list 100

no 30

30 permit ip any any

I'm sorry I didn't know to what interface you were going to bind it

Regards.

Alain.

Re: Restrict Outbound Port 25 to one IP only

iazazkhan — Thu, 20 Oct 2011 15:36:27 GMT

Instead of this access-list 100 permit ip any 192.168.1.0 0.0.0.255 use this

access-list 100 permit ip 192.168.1.0 0.0.0.255 any apart from that the solution provided by the guy is ok

Sent from Cisco Technical Support iPhone App

Re: Restrict Outbound Port 25 to one IP only

conrad2467 — Fri, 21 Oct 2011 04:55:11 GMT

Everybody is in this discussion is partially correct. The final access-list which works is

access-list 100 permit tcp host 192.168.1.13 any eq smtp

access-list 100 deny tcp any any eq smtp

access-list 100 permit ip any any

then on the BVI1 interface

ip access-group 100 in

So Cadet Alain, your first line needed to have the any part after the IP. Otherwise nothing could sent out tcp traffic via smtp. Iazaz and Cadet, both your suggestions work fine for the third line.

Thanks everybody for their help. Glad to have knocked this one on the head. Can breath a bit easier about the possibility of being blacklisted again.

Restrict Outbound Port 25 to one IP only

cadet alain — Fri, 21 Oct 2011 07:42:56 GMT

Hi Conrad,

I want to restrict outgoing smtp traffic to our mail server only.

You're right I had not well read your need, I thought it was only permitting incoming smtp traffic to this host BUT it was outgoing you needed so my ACL was not correct indeed

Happy you solved it though.

Regards.

Alain.