Community discussions

MikroTik App
 
kanyeria
just joined
Topic Author
Posts: 3
Joined: Sat Oct 29, 2016 4:08 pm

port 25

Sat Oct 29, 2016 4:15 pm

Hallo members
please help me how i can block port 25 on my mikrotik router .
thank you in advance
regards
james
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: port 25

Sat Oct 29, 2016 6:24 pm

Not enough info provided. I guess you probably want to block direct smtp access to fight with spam, for which you'd want something like this:
/ip firewall filter
add action=reject chain=forward dst-port=25 protocol=tcp reject-with=tcp-reset
It blocks forwarding tcp/25 from anywhere to anywhere.
 
User avatar
cdiedrich
Forum Veteran
Forum Veteran
Posts: 997
Joined: Thu Feb 13, 2014 2:03 pm
Location: Basel, Switzerland // Bremen, Germany
Contact:

Re: port 25

Mon Oct 31, 2016 5:13 pm

...but only for packets traversing the router.
For blocking SMTP connection attempts to the router itself you've got to duplicate this rule to the input chain.

If there's really heavy attempts to tcp/25 I'm not sure if you do yourself a favor with rejecting it - I'd rather suggest to tarpit or drop the connection which occupies less CPU power - and tarpit additionally binds attackers resources.
-Chris
 
asghari
Trainer
Trainer
Posts: 41
Joined: Thu Feb 07, 2013 4:49 pm
Contact:

Re: port 25

Mon Oct 31, 2016 5:55 pm

you want to block port 25 (SMTP) on witch chain ?
input / output or forward.
you can use the following commands:
/ip firewall filter
add action=drop chain=input port=25 protocol=tcp
add action=drop chain=input port=25 protocol=udp
add action=drop chain=out port=25 protocol=udp
add action=drop chain=fo port=25 protocol=udp
add action=drop chain=fo port=25 protocol=tcp
add action=drop chain=out port=25 protocol=tcp

or you can reject the tcp 25 port with reject action.
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: port 25

Mon Oct 31, 2016 8:37 pm

...but only for packets traversing the router.
Sure, but last time I checked, RouterOS didn't offer smtp server and nothing else uses port 25 by default. It's of course possible that OP set some other service to use port 25, but didn't say so. I just guessed the most likely scenario.