From owner-freebsd-questions@FreeBSD.ORG Thu Jun 22 13:08:14 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E49C716A479 for ; Thu, 22 Jun 2006 13:08:14 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from pi.codefab.com (pi.codefab.com [199.103.21.227]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2BD0943D5D for ; Thu, 22 Jun 2006 13:08:14 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from localhost (localhost [127.0.0.1]) by pi.codefab.com (Postfix) with ESMTP id 473275E3A; Thu, 22 Jun 2006 09:08:13 -0400 (EDT) X-Virus-Scanned: amavisd-new at codefab.com Received: from pi.codefab.com ([127.0.0.1]) by localhost (pi.codefab.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NUlNaNrjQsYy; Thu, 22 Jun 2006 09:08:12 -0400 (EDT) Received: from [192.168.1.251] (pool-68-160-201-170.ny325.east.verizon.net [68.160.201.170]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by pi.codefab.com (Postfix) with ESMTP id 7C0C65CB5; Thu, 22 Jun 2006 09:08:12 -0400 (EDT) Message-ID: <449A9631.6080705@mac.com> Date: Thu, 22 Jun 2006 09:08:01 -0400 From: Chuck Swiger User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 To: kieran@slinq.com References: <1332.80.42.67.159.1150977159.squirrel@mail.digital-crocus.com> In-Reply-To: <1332.80.42.67.159.1150977159.squirrel@mail.digital-crocus.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: Using IPFW to redirect all outgoing SMTP traffic to localhost X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Jun 2006 13:08:15 -0000 Kieran Simkin wrote: > I have an IPFW question that I'm a bit stuck on and > could do with some help. Basically what I'm trying to do is count and > limit the number of e-mails each user on the system is allowed to send. > I've got this working fine within the e-mail server and everything's > dandy, except for the fact that it's easy to bypass the mail server by > making direct SMTP connections to the target hosts. Yes. Use the firewall to do something like: ipfw add pass tcp from any to MAILSERVER 25 keep-state ipfw add pass tcp from MAILSERVER to any 25 keep-state ipfw add unreach filter-prohib log tcp from any to any 25 (I suppose you could use a deny instead, but getting an actual ICMP error is probably more useful in this situation....) -- -Chuck