Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a documentation system that needs to send user updates regularily to users that do not sit on the same network. The network that the documentation system resides is up until now a closed one. I have to allow only mail sent from the network. I have a Netgear Prosafe firewall FVS318. I have simply created a custom rule that blocks all outgoing ports except for port 25 and now 53. is this sufficient?

The ports are now changed as shown in the pictures below

http://i.stack.imgur.com/mrncn.png

http://i.stack.imgur.com/KBJne.png

share|improve this question

2 Answers 2

up vote 1 down vote accepted

The correct (i.e. canonical) way to set this up is:

  • change the default action to "block"
  • Create a rule to allow traffic from port (internal) TCP 0:65535 to (any) TCP 25

That, however, will not be enough for mail to flow through: you also need some sort of DNS resolution. If that isn't already provided (for instance, by using the firewall as DNS server), you also will need to allow UDP and TCP connections to port 53

share|improve this answer
    
+1 but canonical <> correct. –  John Gardeniers Feb 12 '13 at 9:31
    
@Stephane, I wanted to do this but I do not have the option to delete or edit the default value. Or better said I dont know how to access that option –  DavyGravy Feb 12 '13 at 9:32
    
@John I wanted to express the fact that this is not the only way to make it work but that is the recommended way. Sorry if that isn't the usual way to express that in english –  Stephane Feb 12 '13 at 9:36
    
@DavidDrennan There must be a way to change that because otherwise that firewall would be pretty useless. I suspect it is confîgured elsewhere. You mentioned that the network was "a closed one", perhapse if you explained what you mean by that it would make things clearer –  Stephane Feb 12 '13 at 9:38
    
@Stephanie, with regard to the closed network I only meant that it was never intended to have outside access other than for communication between the few machines on the network(dvs no Internet access). Now that network will be connected to the internet through the firewall. I will look to see where I can disable the default setting. I have changed the settings now to allow port 53 to be open and will add the pictures. –  DavyGravy Feb 12 '13 at 9:46

Theoretically it all looks good.

Enable logging initially to see what is going on.

Understanding your routing table on a system level would give you more insight. Your headed in the right direction :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.