SonicWALL open Port 25 to specific external IPs only

Hey everyone.

I am having some trouble configuring the SonicWALL to only accept SMTP traffic from a few external IP addresses. We have Hosted Websense which removes spam for us before sending it along to our server.

I created Address Objects on the SonicWALL with the proper network addresses. I then went to Access Rules on the firewall and enabled these address objects to the WAN interface.

Are these supposed to be pointing to the mail servers internal or external interface? I tried both and neither would work.

Attached 3 pics of the setup config... what have i done wrong?
sonicwall.jpg
sonicwall2.jpg
sonicwall3.jpg
LVL 3
tamaneriAsked:
Who is Participating?
 
digitapConnect With a Mentor Commented:
your best bet to get this to work properly is to run the public server wizard.  run it using smtp as your service.  then, create the address objects that represent the public IPs that you want to explicitly allow ingress (if you have not already), create an address group and add those objects to the group. then, go back to the firewall access rule wan > lan and edit the source using the address group.  you'll want to edit the ingress/egress NAT policies with the group as well.  i think original source for ingress and translated destination for egress.
0
 
tjdabombCommented:
do you also have address objects for websense 2, 3, and 4?  Is there a service in the Sonicwall for "SMTP Receive email"??
0
 
tamaneriAuthor Commented:
I don't see a "SMTP Receive Email" setting.

I see:

SMTP (Anti-Spam Inbound Port)
SMTP (Send E-mail)

I tried it first with Anti-Spam Inbound Port and it wouldn't work either.

I added both SMTP's to the services for my exchange server (see pic), but that opens port 25 to everyone from what I can tell.

Also attached snapshots for the other websense connectors
sonicwall4.jpg
sonicwall5.JPG
sonicwall6.JPG
sonicwall7.JPG
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
tjdabombCommented:
i am not entirely familiar with websense, but, is it possible that you need a pop3 connection to the websense in order to get the email to your local exchange box?  Kinda like your exchange acts like Outlook and needs to pop3 mail inbound from websense.
0
 
Cas KristConnect With a Mentor Commented:
Yes digitap is right run the public server wizard, but it is sufficient to only edit the firewall rule (WAN -> LAN) and change the source to your address group e.g. Websense.
(BTW you can create a group of address objects, put all the ip's and/or ranges in one group and use this group as a source(no need for websense1, websense2 etc) )
0
 
Cas KristCommented:
Thanks for the points, good luck.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.