Slashdot Mirror
They Blocked My SMTP, Now What?
mindsuck asks: "As of this Wednesday, my ISP blocked my port 25, leaving my mailserver useless to the outside world as a consequence of spammers and their nasty worms. So I decided to ask the nice people of Slashdot. What can I do now to restore my smtp service, besides changing ISPs, is there a obscure way to run a mailserver off a non-standard port? What about services similar to those provided by dyndns.org for this kind of situations? Pros and Cons of using this services? Should I move my MX to a more 'stable' server than my homegrown one?" This topic was last touched upon in this article, from 2002. It's been over a year since SMTP blocks have become commonplace. Have you noticed a slowdown in your SPAM? Are ISP SMTP blocks really helping the problem? Updated: It looks like Charter is also blocking SMTP. Might there be a way to work with your ISP to get them to unblock port 25 for you, if you can sufficiently satisfy them that you are not a spammer?
Krondor wrote in with a similar query: "Charter Communications (in my area) has blocked outbound SMTP connections. I need to be able to send Email to other SMTP servers, besides theirs, for a number of legitamate reasons. My question is this; How can I either still send SMTP to the places I need to, or how can I convince Charter to unblock outbound SMTP (I can understand blocking inbound SMTP without ACK bit set)? They do provide a relay, but won't my messages get labelled as SPAM if I use that? I am also concerned because, this relay is not encrypted with SSL and I don't necessarily trust Charter with that."
If you want a practical service it MUST be port 25. If you can't offer port 25, either you need to use someone else's smtp server or to change ISP.
1000s Warcraft Gold while you sleep
Something like this.
Works well as a backup in case your isp goes down too.
RMX, a new DNS record type which lists authorized senders for a particular domain, would have a huge impact in blocking mail with a spoofed sender address. Of course, then spammers could still register their own domains to send from, but those could also be easily blocked, and it would be easier to find the spammers who registered the domain.
I think this has a lot of potential, unlike the other bazillion idiotic non-solutions that have been proposed, like X-mulct headers, for example.
include $sig;
1;
Hopefully this ISP isn't the only cable provider in town. Sure, he can switch to DSL. But why should he have to change his method of receiving internet traffic?
Also, I'm sure the people who drop this ISP because of the SMTP problem is insignificant to the users that don't give a crap. The days of "The Customer is Always Right" are long gone. I'm constantly amazed that people still seem to think that a single irate letter is gonna change anything. It takes a loud cry from many people to get these lethargic corporation to see the error of their ways (or at least get off their buts and do something).
Now, if you can show this ISP some real proof that their approach harms a signficant portion of their user base AND doesn't cut down on the spam problem anyhow, then you might have a shot of getting the ISP to change their policy. Otherwise, I think this poor guy is better off trying to figure out a work-around.
GMD
watch this
Here is how I run a mail server out of my home with port 25 blocked. For incoming mail: My domain will forward any number of e-mail addresses. I have different addresses forwarded to either my cox.net address, hotpop.com, or any of a number of other free POP3 services. On my server, I have an application (free) called poproute that runs every 10 minutes and queries all the pop3 accounts and then sends the mail directly to my internal SMTP server. All the mail goes to the proper internal mailboxes. This gets me around port 25 incoming being blocked. Outgoing Mail: Outgoing mail was very easy. I just set up my mail server to use a smart host and have my smtp server forward outgoing mail to the cox.net server. Cox.net will accept my mail because I am on the inside of thier network, and will then forward it on as if I sent the mail from any mail client. Hope this helps..
I had this happen to me, too, and I use Dynu as my MX, and you can set it to auto-forward my mail from there, to a non-standard port on your host (which for me, the first stop is my firewall, so I have my 'non-standard port' port-forwarded to 25 on my mail machine).
It's not free, unfortunately, ($20 a year I think), but the nice thing is that they'll store 100 MB of email if for some reason they can't deliver it to your host - and since my mail is all done off of my cable, and I live in a weird area (My power was out for 8 hours yesterday because of the intense winds we were having (I live in Maryland)), it's a nice solution for me.
[DISCLAIMER: This post is a work of satire and should not be misconstrued as a holy text upon which to base a religion.]
sorry:
http://fetchyahoo.sourceforge.net/
its a GREAT program!
--
"It is now safe to switch off your computer."
I work for a major cable ISP here and we are also having problems with spamming trojens. To solve it we do not want to block the customer's out going smtp completly
I work for a small ISP. We worked around this problem a little differently..
Instead of blocking outbound SMTP, we opted to transparently proxy outbound SMTP sessions to our mail server.
The mail server does connection-rate throttling, and if the load on the server exceeds 'normal', the on-duty admin gets paged, so he can check the mail queue to see where the problem is - if it's a spam run, we shut off the ability for that customer to send SMTP, and purge the spam from the queue.
This has worked exceedingly well for us - the one time someone's machine has been used for spam (in the past 3 years), we were able to shut it off with only 2 spams making it out of our system.
I don't know how well it would scale for you, but it should be do-able.
There are a couple of justifications for this. Some are probably more realistic than others.
My cable-modem ISP (Cox) blocks outbound 25. This is a minor only a minor issue to me because Cox's outbound mail servers are generally:
I receive mail with co-lo servers that are part of my business.
The comment of not trusting outbound relaying because they might look at it is a bit misplaced. Looking at internet traffic is pretty easy for anyone with the desire and means to do so. If you send outbound SMTP on your cable modem, your ISP can look at the packets if they have the desire to do so (and I doubt that this breaks any laws). It does not really matter if they relay the traffic or not. They have physical access to the network, so they can sniff either way. On the other hand, they are pretty unlikely to do so unless they are asked by some governmental agency. Basically, sniffing such large amounts of data is uninteresting to them, so why would they bother. If you are worried about eavesdropping on email, encrypt.
In your case, I suspect that the blocks have two reasons:
Inbound blocks to 25 are just an enforcement to a no servers rule. I suspect that there are also blocks on 80 and perhpas a bunch of others. In all fairness, I would hate to run a mail server in-house on a cable modem. Mail is just too important to me, and I don't trust my in-house systems to be up 24x7. That is what co-lo is for.
Outbound blocks to 25 are an attempt to slow down spam. Specifically, they prevent hacked home systems from becoming SMTP relays. In general, this is probably a good thing and most users with hacked boxes never know the damage they are doing.
Your only real solutions that you have are:
None of these are 100% free or pretty, but the bottom line is that you are using your cable-modem line in a manner that doesn't fit your provider's pre-conceived image of the type of user they have/want.
On the other hand, the solutions above are not necessarily that expensive either. You can get email hosting with adequate access for <$10/mo, co-lo virtual servers for <$15/mo, and full dedicated co-lo servers for <$100/mo.
I don't want free as in beer. I just want free beer.
I was curios so I asked a Cox support person on chat what was blocked. They have a page published on this. You can get there by searching for "blocked" on their FAQ.
I see a couple of ports in your list that are not in theirs, so the FAQ may be a little out of date.
In general, I would love to see a "control panel" that let you set this up yourself (instead of making it global), but there choices are not unreasonable on the surface. They also appears to be full disclosure here, so I would compliment Cox in this area.
Here is a cut-and-paste of their FAQ.
What ports do you block?
Answer:
Reasons For Filtering Ports
Protecting our customers - Certain ports are filtered in order to protect our customers. We can protect them from certain common worms and protect them from running dangerous services on their computers that could allow intruders access.
Protecting our upstream bandwidth - Upstream bandwidth to a cable plant is limited. If customers over utilize their upstream bandwidth by running high-traffic servers or becoming infected with a worm or virus, it can degrade the service of other customers on their node.
Protecting the rest of the Internet - Some filters prevent our customers from attacking other computers on the Internet. In addition to being in our best interests for protecting our bandwidth, it is our duty as good Netizens to prevent abuse of our network.
Port Transport Protocol Direction Reason for Filtering
25 TCP SMTP Both* SMTP Relays
80 TCP HTTP Inbound Web servers, worms
135 UDP NetBios Both Net Send Spam/Pop-ups, Worms
136-139 UDP, TCP NetBios Both Worms, Network Neighhood
445 TCP MS-DS/NetBios Both Worms, Network Neighhood
1433 TCP MS-SQL Inbound Worms, Trojans
1434 UDP MS-SQL Inbound Worms, SQLslammer
1900 UDP MS-DS/NetBios Both Worms, Network Neighhood
27374 TCP Subseven Both SubSeven Trojan
*SMTP is only permitted outbound to Cox-provided SMTP servers
Detailed Explanations Of Filtered Ports
25/TCP - SMTP. SMTP stands for Simple Mail Transport Protocol. This is the protocol that mail servers use to exchange email. We block this in order to protect upstream bandwidth and prevent customers from running open relays could potentially be used by others to send spam via our network.
80/TCP - HTTP. HTTP stands for Hypertext Transport Protocol. This is the protocol web browsers use to communicate with web servers. In addition to protecting bandwidth by preventing customers from running high-traffic web servers, we can stop many destructive worms that spread via security holes in web server software.
135,137/UDP, 135,139/TCP, 445 MS-DC - NetBIOS. NetBIOS (also known as Server Message Block, LanManager, and Common Internet File System) is a networked file sharing protocol. The Microsoft Windows "Network Neighborhood" runs over NetBIOS. We filter this port to protect customers from inadvertently exposing files on their computers, and also to block worms which spread via open file shares. The latest addition to this series, a consolidated service port (TCP445), has also opened new (yet similar) security risks in Win2K and WinXP.
1433/TCP, 1434/UDP - MS-SQL. Microsoft SQL Server (and software designed with SQL Server components) is a database application with a long history of security exploits, and is noted for the propagation of the SQLslammer worm. These ports are filtered to prevent exploitation and propagation of MS-SQL exploits.
1900/UDP - UPnP discovery/SSDP, is a service that runs by default on WinXP, and creates an immediately exploitable security vulnerability for any network-connected system. Filtering this port proactively prevents XP systems from being remotely compromised by malicious worms or intruders.
27374/TCP - SubSeven. SubSeven is a common trojan. When installed on a victim's computer, it allows an attacker to remote control it over the Internet. SubSeven can be configured to run on any port - not just 27374 - but blocking this port at least provides our customers some protection and prevents our customers from attacking others on the default port.