Hello all,

I cannot really believe that this qualifies as a *new* topic, but I seem to be having just as much difficulty with the search facility in this forum as I am with my Vigor 2862n router, so I need some assistance from the community please.

I am upgrading from a Netgear ProSafe VPN Firewall SRXN32005. On this I could set a global block on inbound connections, and then open up specific ports (as defined by the selected service) which direct traffic to a specific internal LAN IP address. For the most part this would be the mail server (we are running SBS2011 with built-in Exchange Server, SharePoint, etc.)

I have tried the same configuration within the Vigor 2862n by changing the default rule to 'block' (although it doesn't seem clear if this is inbound traffic, outbound traffic or all traffic in and out), adding the ports I'm interested in either as individual services or groups of services, and creating rules within the firewall filter sets using the source IP address as any WAN address and the destination as the server address on the LAN. Nothing comes in. Interestingly I also have a rule for outbound traffic which is supposed to block activity on port 25 from anything but the mail server to stop mail bots if ever we get infected, yet that doesn't seem to be working either since my non-domain controlled laptop can happily send and receive e-mail. Clearly I am doing something wrong in both counts. I have made sure that all the rules I am using are themselves enabled, and that the Data Filter is enabled within the General Setup. Do I have to set up additional NAT rules to point incoming mail to the server, or should the firewall rule I have specified do that for me?

A summary of the inbound rules I use would be along these lines:

Direction: WAN -> LAN/DMZ/RT/VPN
Source IP: Any
Destination IP: 192.168.2.2
Service: Server Mail (itself defined as TCP ports 25->25 and 143->143)
Filter: Pass Immediately
All other settings left as default.

Any advice would be greatly received.

Thanks in advance,

Angus

AngusK wrote: Interestingly I also have a rule for outbound traffic which is supposed to block activity on port 25 from anything but the mail server to stop mail bots if ever we get infected, yet that doesn't seem to be working either since my non-domain controlled laptop can happily send and receive e-mail.

Are you sure the laptop isn't sending mail using some other port, such as 465 or 587?

and he wrote: Do I have to set up additional NAT rules to point incoming mail to the server, or should the firewall rule I have specified do that for me?

Yes (to the first question).

The 'NAT rule' tells the router how to remap the traffic and the firewall rule says who/what can make use of it. In your case, since you aren't changing the port numbers with NAT, you'll probably want to set entries in "NAT->Open Ports", rather than "NAT->Port Redirection".

changing the default rule to 'block' (although it doesn't seem clear if this is inbound traffic, outbound traffic or all traffic in and out)

I believe this is for outbound, as WAN to LAN is always blocked even if you keep it as default (allow)

hornbyp wrote: Are you sure the laptop isn't sending mail using some other port, such as 465 or 587?

You may be right there, actually. Either way, with the default rules set to 'Block' I was still surprised to see Outlook connect.

then hornbyp wrote: In your case, since you aren't changing the port numbers with NAT, you'll probably want to set entries in "NAT->Open Ports", rather than "NAT->Port Redirection".

I will give that a go. Is it simply a case of using Source IP = ANY and Destination IP = 192.168.2.2 (i.e. the server)?

Thank you for your help.

Spellbinder wrote: I believe this is for outbound, as WAN to LAN is always blocked even if you keep it as default (allow)

Curious how my laptop was able to connect to my external mail service, then. Any thoughts as to why this may have happened?

Ok so maybe then actually it is for inbound but only when you set up port forwarding ;) When on allowed, when you create a NAT entry, the traffic is allowed. If you set it to block, you will need to create a firewall rule to allow the inbound connection ;)