North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Why do so few mail providers support Port 587?

  • From: Adrian Chadd
  • Date: Tue Feb 15 22:05:43 2005 
On Tue, Feb 15, 2005, Erik Amundson wrote:
> 
> I just get sick of providers blocking traffic...their job is to PASS
> TRAFFIC.  There must be a better solution, but laziness is getting the
> better of us all, as usual.
> 
> We've had so many problems with "IP Providers" blocking various "IP
> PROTOCOLS" that we've just ended up forcing all of our users to use VPN
> tunnels for everything...except when the providers block that!!!  Then
> we're just screwed.
> 
> Anyways, just my two cents...
> 
> Please don't flame me, I'm just a lowly network guy....:)

I used to agree with this. This was, of course, until I started
being the poor sap at the end of the huge spam floods or massive DDoS
attacks.

My upstream provider blocks the following ports, just as an example:

 deny   tcp any gt 1023 any eq 445
 deny   tcp any gt 1023 any eq 135
 deny   tcp any gt 1023 any eq 1025
 deny   tcp any gt 1023 any eq 2745
 deny   tcp any gt 1023 any eq 6129
 deny   tcp any gt 1023 any eq 9898 syn
 deny   tcp any gt 1023 any eq 5554 syn
 deny   tcp any gt 1023 any eq 1023 syn
 deny   tcp any gt 1023 any eq 139
 deny   tcp any gt 1023 any eq 1433
 deny   tcp any gt 1023 any eq 3127
 deny   tcp any gt 1023 any eq 5000
 deny   udp any gt 1023 any eq 1026
 deny   udp any gt 1023 any eq 1027
 deny   udp any gt 1023 any eq 1028
 deny   udp any gt 1023 any eq 1029
 deny   udp any gt 1023 any eq netbios-ns
 deny   udp any eq 4000 any gt 1023
 deny   udp any gt 1023 any eq 1434
 permit ip any any

.. and they've reported to me (and I wonder if they're on the nanog
list :) that they're seeing more traffic hit this ACL than 'normal'
traffic passing. This may not hold true for /all/ network traffic
and I'm sure a lot of you will be seeing different traffic patterns
but it still shocked me. I've had a few people request services
which this ACL does filter and my reply is now always "use a VPN"
or "use a tunnel" or "buy ${SMALL_VPN_APPLIANCE}".

I don't like filtering. I liked the day when my ISPs mailserver would
break - so I'd just use another ISP for outbound mail until it was
fixed. Sob.




Adrian


-- 
Adrian Chadd			"You don't have a TV? Then what's
<[email protected]>	    all your furniture pointing at?"