PF Allow Outlook through PF firewall

C

cracker1985

Hello everyone,

Our domain users authenticate from Squid through Samba services. They need to send and receive email with Outlook from a Terminal Server session. Terminal Server IP adresses are 192.168.99.128/25. But they can't. Help me please and consider I am not a FreeBSD professional. My pf.conf is as below:
OS: Freebsd FreeBSD 9.2 and Squid

Code: 
ext_if="em2"

ext_ip="x.x.x.x"

int_if="em0"

sync_if="em1"

vlan1000_if="vlan1000"

safe_ports="{ 53,8080,22,8140 }"

safe_nat_ports="{ 110,25,143,993,443,587,465,995,3000,389,21,20,53,161,3389 }"

table persist file "/etc/clients/clients.conf"

#set block-policy drop

set skip on lo0

set skip on $int_if

set skip on $vlan1000_if

#set debug misc

scrub in all

nat-anchor "ftp-proxy/*"



rdr-anchor "ftp-proxy/*"

nat on $ext_if from 192.168.99.128/25 to any port $safe_nat_ports -> $ext_if

nat on $ext_if from 12.0.0.0/21 to any port $safe_nat_ports -> $ext_if

nat on $ext_if from to any -> $ext_ip

nat on $ext_if from 192.168.99.128/25 to any port 25 -> $ext_if

nat on $ext_if from 192.168.99.128/25 to any port 110 -> $ext_if

pass in all

block out quick on ext_if proto tcp to port 445

block out quick on ext_if proto udp to port 445

pass out all

antispoof quick for { lo $int_if }
 
The best way I have found to solve this problem is to set up a pflog device for your blocked traffic by adding a log directive to any block rules in your pf.conf. Then you can use tcpdump on the pflog device to see what packets from Outlook are getting blocked, and then modify your rules accordingly until they are getting through.

Hope that helps!
 
Oko said:
Doesn't Outlook use TCP port 587 a.k.a. submission? Why is port 25 open?
Click to expand...
Outlook is just a mail client like Thunderbird, what matters are the outgoing and incoming mail servers. You must set exceptions in the firewall log for (which is what the OP did already):
  • POP3 - port 110
  • IMAP - port 143
  • SMTP - port 25
  • HTTP - port 80
  • Secure SMTP (SSMTP) - port 465
  • Secure IMAP (IMAP4-SSL) - port 585
  • IMAP4 over SSL (IMAPS) - port 993
  • Secure POP3 (SSL-POP) - port 995
 
You are going to have to allow out (and in, if necessary) the needed ports.
Code: 
# Allow outgoing
pass out on $ext_if proto any to any port $safe_nat_ports
 
You must log in or register to reply here.
Back
Top