Configuring an SMTP proxy service

The SMTP proxy limits several potentially harmful aspects of e-mail. The proxy scans the content type and content disposition headers and matches them against a user-definable list of known hostile signatures. E-mail containing suspect attachments is blocked and replaced with messages indicating that this action has been taken.

The list of disallowed signatures can be modified from the Content Types tab in the SMTP Proxy dialog box. You do not have to reboot the Firebox when you make these SMTP configuration changes.

The proxy also automatically disables nonstandard commands such as Debug, and can limit message size and number of recipients. If the message exceeds preset limits, the Firebox refuses the mail.

The Policy Manager uses separate dialog boxes for incoming and outgoing SMTP rules. Because incoming messages pose a greater threat to your network than outgoing ones, the dialog box for incoming SMTP has more controls and configurable properties.

Configuring the incoming SMTP proxy

Use the Incoming SMTP Proxy dialog box to set the incoming parameters of the SMTP proxy. You must already have an SMTP Proxy service icon in the Services Arena. From the Services Arena:

Double-click the SMTP Proxy icon to open the SMTP Proxy Properties dialog box:
Click the Properties tab.
Click Incoming.

The Incoming SMTP Proxy dialog box appears, displaying the General tab.
Modify general properties according to your preference.

For a description of each control, right-click it, and then click What's This?.
To modify logging properties, click the Logging tab.

Selecting content types

From the SMTP Proxy Properties dialog box:

Click the Content Types tab.
Click Add under the Content Types box.

The Select MIME Type dialog box appears.
Select a content type. Click OK.
To create a new MIME type, click New Type. Enter the MIME type and description. Click OK.

The new type appears at the bottom of the Content Types drop list. Repeat this process for each content type. For a list of MIME content types, see the Reference Guide.

Adding address patterns

From the SMTP Proxy Properties dialog box:

Click the Address Patterns tab.
Use the Category drop list to select a category.
Type the address pattern in the text box to the left of the Add button.
Click Add.

The address pattern appears at the bottom of the pattern list.

Protecting your mail server against relaying

Hackers and spammers can use an open relay to send mail from your server. To prevent this, disable open relay on your mail server. From the SMTP Proxy Properties dialog box:

Click the Address Patterns tab.
Select Allowed To from the Category drop list.
In the text box to the left of the Add button, enter your own domain.

With this setting, outside IPs can send mail only to your domain and not relay to other domains.
Click Add.

Select headers to allow

From the SMTP Proxy Properties dialog box:

Click the Headers tab.
To add a new header, type the header name in the text box to the left of the Add button. Click Add.

The new header appears at the bottom of the header list.
To remove a header, select the header name in the header list. Click Remove.

The header is removed from the header list.

Configuring the outgoing SMTP proxy

Use the Outgoing SMTP Proxy dialog box to set the parameters for traffic going from your Trusted and Optional network to the world. You must already have an SMTP Proxy service icon in the Services Arena. Double-click the icon to open the service's Properties dialog box:

Click the Properties tab.
Click Outgoing.

The Outgoing SMTP Proxy dialog box appears, displaying the General tab.
To add a new header pattern, type the pattern name in the text box to the left of the Add button. Click Add.
To remove a header from the pattern list, click the header pattern. Click Remove.
Set a time-out value in seconds.
To modify logging properties, click the Logging tab.

Add masquerading options

SMTP masquerading converts an address pattern behind the firewall into an anonymized public address. For example, the internal address pattern might be inside.salesdept.bigcompany.com, which would be anonymized to their public address bigcompany.com.

Click the Masquerading tab.
Enter the official domain name.

This is the name you want visible to the outside world.
In the Substitute text box, type the address patterns that are behind your firewall that you want replaced by the official domain name.

All patterns entered here appear as the official domain name outside the Firebox.
In the Don't Substitute text box, type the address patterns that you want to appear "as is" outside the firewall.
Enable other masquerading properties according to your security policy preferences.