The Email Proxy facility is used to configure an SMTP (Simple Mail Transfer Protocol) proxy for inbound email on TCP port 25. The administrator can use the Email Proxy to shield an internal email server from unauthorized access and reduce or eliminate spam (unsolicited email). It includes the ability to log SMTP ìToî and ìFromî addresses when rejecting email. As email is received, X-From and X-To entries will be added to the email header.
The Email Proxy compares the source IP address of incoming messages to the IP addresses of known spammers listed in the enabled Mail Abuse Prevention RBLs (Realtime Blackhole Lists). If a source matches one of these, the IP address is logged, and the message is permanently rejected (the firewall returns a ìdo not send againî packet to the source IP address) and dropped.
Email Proxy on the GTA Firewall appends the Received, To and From addresses contained in the initial SMTP (Simple Mail Transfer Protocol) conversation as X-GB-Received, X-GB-To and X-GB-From. The prefix shows that this header was appended by a receiving GNAT Box system firewall, as in the following example:
X-GB-Received: from domain.example.com (192.168.71.9)
by gtafirewall.yourcompany.com (3.5.0)
X-GB-From: sendername@sendexample.com
X-GB-To: recipient@yourcompany.com
The ìX-GB-Receivedî line contains the domain name/host where the email originated, followed by the host name and IP address of the receiving firewall. The ìX-GB-Fromî line contains the email address of the sender. (The originating domain and the domain in the senderís email are not necessarily the same.) The ìX-GB-Toî line contains the email address of the intended recipient at your companyís domain.
GTA recommends that the host name be a fully qualified domain name (FQDN), as in the example above. The firewall host name is entered in the HOST NAME field of the Basic Configuration/Network Information section.
Selecting the option ìReject if RDNS failsî performs a Reverse DNS lookup on the IP address of the remote host trying to make an SMTP connection, and then compares it to a DNS lookup of the returned host name. If the lookup fails or doesnít match, the connection is refused. RDNS requires a defined DNS Server to function correctly.
Primary email server/Alternate email server
Providers listed in Mail Abuse Prevention maintain lists of hosts and domains known to transmit or generate spam. These are only a sample of the many lists available; you may enter other providers in lieu of the default providers listed. Some lists require a subscription; for more information, go to the providerís website.
MAP1
* Mail Abuse Prevention System LLC lists require a subscription.
To configure an email proxy with default settings, enter the mail server's internal IP address in the Primary email server field. (Typically, a mail server will be on the PSN or Protected Network.) Enable and save the email proxy.
Email Proxy requires a Remote Access Filter to allow access to the network for protocol TCP on port 25. To create a filter (once Email Proxy has been enabled), auto-configure filters using the Default button. The filter is similar to the following:
Port TCP/25 accepts SMTP proxy connections on all IP addresses, therefore the Email Proxy will respond on any IP address that has port 25 open. The auto-configure filter limits that access to IP addresses on the logical External interface by using the EXTERNAL object in the Interface field.
To further limit the IP addresses accessed by SMTP, create a custom remote access filter that allows access only to a specific IP address, address object or IP alias on the physical External interface.
The logical name of the selected External interface can also be selected as an Interface Object, limiting the access only to the assigned External IP address on the physical interface.
¨ Caution
IP address that receives mail for the Email Proxy should not be used in an inbound tunnel on TCP port 25. A tunnel on port 25 using this IP address will bypass the Email Proxy.
¨ Note
When creating a custom filter, remember that it must be placed before the final block filter that denies all other access to all interfaces.
¨ Note
If ìReject if RDNS failedî is selected, legitimate hosts with mis-configured DNS entries will not be able to deliver to your domain.