Liddler is correct, your firewall should only allow outbound TCP port 25 (SMTP) from the IP address of your mail server.
However, I'm not sure from your post if you host your own email, (and if so if you're using Exchange or other) or if you have a third party hosting, etc. But either way, you may want to do some packet level logging/inspection of your outbound traffic to get a clear picture of the SMTP traffic leaving your network.
Most firewall/routers will allow you to view/log outbound TCP port 25 and see what internal IP addresses are making outbound connections. You could very well have an infected machine mass mailing junk, or it could be your email server is infected. Also make completely sure that your email server is running up to date antivirus software, and that you've scanned and cleaned any infections on it.
Main Topics
Browse All Topics





by: liddlerPosted on 2009-08-24 at 05:51:20ID: 25167747
port 25 (SMTP) is used by mailservers, a PC does not to have port 25, as it is a mail client (IMAP / POP).
The only machines in your network that should be allowed port 25 outbounds are your mailservers.
You should block all mail traffic, except for your mail server, at your perimeter (firewall, router gateway) rather than just each PC.