How to open up SMTP port on Cisco 800 series router?

Try adding this to the access-list on your external interface:

Access-list <list#> permit tcp any host X.X.X.X eq smtp

where X.X.X.X is the IP address of your mail server, and <list#> is the access list number you are configuring.  You must be in global configuration mode to add to the list.  Access lists are what prevent and allow packets hitting your router.  If you have a deny entry in the access list that is denying the smtp packets...the above line will need to be entered into the access list before the deny line.  This is because once a packet matches a specific line in the access list, all other lines in the list are ignored.

It is useful to use the "?" command when trying to understand the different options in these access list commands.  For example if you are typing the above command but type a "?" after "permit" you will be provided with a list of available commands to follow the "permit"

What does the eq stand for in teh command like also i presume instead of actually writing smtp i type '25' instead, also does it matter what number access list i put it in?

Thanks

Daniel

The eq is saying to match a specific port number, which you give with the next command "smtp", which yes means port 25.  And you dont need to type 25, you can just type "smtp".

if you don't want to specify which server on your network you want to allow the traffic to (you want to allow smtp traffic bound for all internal computers) use this command:

Access-list <list#> permit tcp any any eq smtp


Yes, it does matter which Access-list number you put it in.  You need to know which access list # is currently applied to your external interface.  This is the access list number you need to add the permit command to.  You can see which Access list is applied to your interface with the "show run" command.

To clarify the eq part; if you didn't have this portion in the command such as:

Access-list <list#> permit tcp any host X.X.X.X

then you would be opening all ports to packets incoming to the specified IP address.

Thanks for that.

Please bear with me on this, if I could just clarify.......

I have gone into config t and entered the access list as you originally stated as access-list 110 permit tcp any host 192.168.x.x eq smtp (this address is the Surf Control Email filter, that then forwards mails to the exchange)

Now when I do a sh run I see the access list listed but above it a see other access lists and at the very top one which is access-list 101 says access-list 101 permit ip any any, which in theory must mean everything is open at the moment so why is mail still not flowing

Am I missing something? also how do i remove the access-list?

Thanks

Daniel