Forum Discussion
NimbostratusPrevent open mail relay
We're currently running F5 LTM (11.6) for our Exchange 2013 environment. We have Source Address Translation set to Automap. We have servers set to point to the VIP, and we are allowing the Self-IP on the receive connector. While it works, it's a security risk. I know one way to solve it, is to not use SNAT, and have the exchange servers use the F5 as their default gateway, but with the way our addressing is, I can't see this not causing routing issues.
As an alternative, is the best option to create a data group list, specifying the server IP addresses that should be allowed to relay. Then, create an iRule that checks the DG, if it's a match, point that to a different self IP?
In theory, I think this would work, but not sure how exactly how to write the iRule.
Any help would be appreciated
6 Replies
Janek_42109Hello,
You can create an irule like this where SMTP_EXCHANGE_SERVERS is a Data Group List of Address
when CLIENT_ACCEPTED { if { not [matchclass [IP::remote_addr] equals SMTP_EXCHANGE_SERVERS] } { TCP::respond "554 Denied.\r\n" TCP::close }I hope it helped
markn11_229516Hi Janek,
Thanks. That helps a lot! What if I wanted to have 3 different receive connectors for difference purposes, like 2 application connectors and then the default receive connector??
For example
If IP:remote_address equals DataGroup1 snat to 10.10.10.100
If remote_address equals DataGroup2 snat to 10.10.10.200
else snat automap (to the IP address it was using all along)
- markn11_229516
I tried to copy and paste the code you sent, but my F5 didn't like it. Not sure if I'm not running the right code.
I was able to get it to work by using this as an iRule. It works if I use client_addr or remote_addr. Not sure if one is preferred over the other. Do you think this is acceptable?
when CLIENT_ACCEPTED { set accepted_snat "10.10.10.100"
if { [ class exists SMTP_EXCHANGE_SERVERS ] } { if { [class match [IP::client_addr] equals SMTP_EXCHANGE_SERVERS] } { snat $accepted_snat } else { snat automap } } else { snat automap } }
- markn11_229516
I tried to copy and paste the code you sent, but my F5 didn't like it. Not sure if I'm not running the right code.
I was able to get it to work by using this as an iRule. It works if I use client_addr or remote_addr. Not sure if one is preferred over the other. Do you think this is acceptable?
when CLIENT_ACCEPTED { set accepted_snat "10.10.10.100"
if { [ class exists SMTP_EXCHANGE_SERVERS ] } { if { [class match [IP::client_addr] equals SMTP_EXCHANGE_SERVERS] } { snat $accepted_snat } else { snat automap } } else { snat automap } }
- markn11_229516
when CLIENT_ACCEPTED { set accepted_snat "10.10.10.100" if { [ class exists SMTP_EXCHANGE_SERVERS ] } { if { [class match [IP::client_addr] equals SMTP_EXCHANGE_SERVERS] } { snat $accepted_snat } else { snat automap } } else { snat automap } }text - Janek_42109
Hello,
[IP::client_addr] is fine. Good to hear that it's working for you.
