I know this is a noob question, but I haven't been able to find an answer on exactly what I'm looking for.
My mail server was recently blacklisted due to being infected with cutwail. Part of the de-listing instruction is to block port 25, specifically:
"The simplest and most effective way to stop this is to configure your NAT to prohibit connections to the Internet on port 25 except from real mail servers. Not only does this stop all of these viruses and spams dead in their tracks, the NAT logs will immediately tell you the LAN address of the infected machine."
Looking through our ISA rules (I inherited this setup, so I'm not familiar with everything on it), we have two pertaining to SMTP: one to allow all from local host to external, and one to allow all from external to local host. I assume this isn't what I want.
So to be compliant, I would like to block port 25 on our SBS 2003. We only have this one server, which provides us with NAT as well as acts as our Exchange server.
How do I, as they request, "block port 25 except from real mail servers" without interfering with our email functionality?