With Exchange 2003, should SMTP be accessible externally over port 25?

Question

Please excuse if this is a n00b question. I'm a programmer acting as a network admin.

We received a large number of failed audit events in our security event log which appears to be a brute force attack on our Exchange 2003 server. The log details are as follows:

Event ID: 529
Process: Advapi
Logon Type: 3
User Name: (all sorts of strange usernames)
ProcessID: (points to Inetinfo.exe)

So I am guessing that our Exchange/SMTP is accessible publicly on port 25. Is it a good idea to set up a firewall rule to block external access on port 25? (and only allow traffic from within our network?)

Note that we use the Exchange mail website when working from home and need to be able to continue doing so.

PS: The server runs Windows Small Business Server 2003 and also acts as the domain controller.

Answer 1

If you expect to receive email from the Internet, then some SMTP device on your network must be open and accepting connections on port 25. These days it is pretty common to have some kind of anti-spam device in the path instead of directly exposing your mailbox server though.

Assuming you don't have an anti-spam gateway in front of your Exchange server, then yes, you almost certainly need port 25 open.

You might want to investigate putting something in place, or subscribing to one of the mail services that sit in front of your mailbox server. Then block incoming access to the Exchange server from everything except the mail gateway.