[manulite]

Hi

I'm still climbing the linux expert ladder and i've gone up only a few notches up, so i really need some expert advice from you guys. What i need is probably simple.

I have a linux server (Mandrake 8.2) which was being used for email (popping and sending using outlook clients) Now the organisation has decided to use an existing Lotus Domino server which is inside the Local area network for all external email. The linux server(running sendmail) now acts as a mail proxy which routes all email to the Domino Server.

The problem i have now is the outlook clients are *still* configured to pop and send directly to linux and i want to disable that on the linux server. Popping is not really a problem i figured you can disable the pop3d service but how do you disable clients from sending directly to my sendmail box?

There are more than 700 clients and everyone has lotus notes so we just notified people to use outlook instead on outlook but some people are still using outlook. No reconfiguration of clients took place.

[Dolda2000]

One thing that you can do is to block traffic to port 25 from all other computers than the Domino server. To do that, run this (provided you're running a 2.4 kernel with iptables; tell me otherwise), where you replace 1.2.3.4 with the IP address of the Domino server:

iptables -A INPUT -s ! 1.2.3.4/32 -p tcp --dport 25 -j REJECT --reject-with tcp-reset

[manulite]

my kernel is 2.4.18 so it might work, my question is will it not affect incoming external connections?

[Dolda2000]

Oh yeah, this one receive mail as well. I forgot that.
Then tell me, do you have two NICs in it or does it only have one?

[manulite]

yes i do have two NICs

[Dolda2000]

I suppose that means that one is connected to the internal network, on which only the Domino server should be admitted, and one connected to the internet, where everyone should be admitted, right? If so, use this command instead, where you replace ethx with the name of the internal NIC:

iptables -A INPUT -i ethx -s ! 1.2.3.4/32 -p tcp --dport 25 -j REJECT --reject-with tcp-reset

[manulite]

It works! you've been very helpful thanx lots