Firewall rules for email (SMTP/S,POP3)

[isonski]

hello,

im having problem with firewall rulings with regards to email ports… i blocked all ports and managed to get port 80 (http) to pass, but when i set the ports for email (110,465,25) it cant connect to the mail server... bellow are the rules i set:
Status                Proto          Source        Port              Destination        Port            Gateway
pass(disabled)      *                LAN net      *                  *                    *                  *
block                  *                LAN net      *                  WAN address    *                  *
pass                  TCP            LAN net      80 (HTTP)      WAN address    80 (HTTP)      *
pass                  TCP/UDP      LAN net        110 (POP3)      WAN address    110 (POP3)      *
pass                  TCP            LAN net        465 (SMTP/S)  WAN address    465 (SMTP/S)  *
pass                  TCP            LAN net        25 (SMTP)        WAN address    25 (SMTP)      *

if you'll notice, i've disabled the first rule (the default rule), and immediately set to block all ports (2nd rule), followed by the ports that i want to pass thru (succeeding rules)… so far, the only rule working is in port 80 (http), but email ports are not passing thru...

based from what i read from the forums, rules are applied sequencially based on what is set first... i tried to re-shuffle the rules and setting the "block" rule at the end of the set, but i still cant get it to work...

any tips or info regarding this is very much appreciated...

TIA guys :)

allison

[GruensFroeschli]

Delete your first two rules (the disabled pass and the block rule).
Also set the "source port" to *
When a connection is initiated , the source port is something completly ramdom between 1024 and 65535.
(see my sig ;) )

[isonski]

hello again…

thanx for the immediate reply to my post... :)

i did as u instructed, removed the first two rules and set the source ports to "*", but emails still cant pass thru...

wat else could i be missing out here...???

thanks again :)

allison

[Perry]

If you only use the default rule does it work then?

http://doc.m0n0.ch/handbook/examples.html
might help you out?

[isonski]

hi Perry,

thanx for ur reply… yes, it works when i restore the default firewall rule... but then again, by doing so all ports will be open... is there any other work around for this...???

thanks again :)

[dvserg]

Also may be pass tcp DNS and all ICMP ?
Can you telnet from lan to any mail-server by ip on 25 and 110 port's?
(For example from windows cmd 'telnet ip-mail-server 110')

[isonski]

unfortunately, i cant telnet to the mail server on either ports 25 and 110… i can do so when i set the default rule again...

[Cry Havok]

You've got the rules listing the destination as the WAN IP of the pfsense host.  I assume this isn't what you want.  Either set it to any, or specify the remote server IP.

[Perry]

Cry Havok beat me to it :D

Read 14.1.4 and 14.1.5 in mono doc

[dvserg]

pass      TCP/UDP      LAN net        110 (POP3)      WAN address    110 (POP3)      *
pass      TCP/UDP      LAN net        *    *    110 (POP3)      *