nanog mailing list archives
Re: Why do so few mail providers support Port 587?
From: Adrian Chadd <adrian () creative net au>
Date: Wed, 16 Feb 2005 03:04:10 +0000
On Tue, Feb 15, 2005, Erik Amundson wrote:
I just get sick of providers blocking traffic...their job is to PASS TRAFFIC. There must be a better solution, but laziness is getting the better of us all, as usual. We've had so many problems with "IP Providers" blocking various "IP PROTOCOLS" that we've just ended up forcing all of our users to use VPN tunnels for everything...except when the providers block that!!! Then we're just screwed. Anyways, just my two cents... Please don't flame me, I'm just a lowly network guy....:)
I used to agree with this. This was, of course, until I started being the poor sap at the end of the huge spam floods or massive DDoS attacks. My upstream provider blocks the following ports, just as an example: deny tcp any gt 1023 any eq 445 deny tcp any gt 1023 any eq 135 deny tcp any gt 1023 any eq 1025 deny tcp any gt 1023 any eq 2745 deny tcp any gt 1023 any eq 6129 deny tcp any gt 1023 any eq 9898 syn deny tcp any gt 1023 any eq 5554 syn deny tcp any gt 1023 any eq 1023 syn deny tcp any gt 1023 any eq 139 deny tcp any gt 1023 any eq 1433 deny tcp any gt 1023 any eq 3127 deny tcp any gt 1023 any eq 5000 deny udp any gt 1023 any eq 1026 deny udp any gt 1023 any eq 1027 deny udp any gt 1023 any eq 1028 deny udp any gt 1023 any eq 1029 deny udp any gt 1023 any eq netbios-ns deny udp any eq 4000 any gt 1023 deny udp any gt 1023 any eq 1434 permit ip any any .. and they've reported to me (and I wonder if they're on the nanog list :) that they're seeing more traffic hit this ACL than 'normal' traffic passing. This may not hold true for /all/ network traffic and I'm sure a lot of you will be seeing different traffic patterns but it still shocked me. I've had a few people request services which this ACL does filter and my reply is now always "use a VPN" or "use a tunnel" or "buy ${SMALL_VPN_APPLIANCE}". I don't like filtering. I liked the day when my ISPs mailserver would break - so I'd just use another ISP for outbound mail until it was fixed. Sob. Adrian -- Adrian Chadd "You don't have a TV? Then what's <adrian () creative net au> all your furniture pointing at?"
Current thread:
- Re: Why do so few mail providers support Port 587?, (continued)
- Re: Why do so few mail providers support Port 587? Valdis . Kletnieks (Feb 24)
- RE: Why do so few mail providers support Port 587? andrew2 (Feb 25)
- Re: Why do so few mail providers support Port 587? Paul Vixie (Feb 24)
- Re: Why do so few mail providers support Port 587? Andrew - Supernews (Feb 24)
- Re: Why do so few mail providers support Port 587? Robert L Mathews (Feb 26)
- Re: Why do so few mail providers support Port 587? Jim Popovitch (Feb 26)
- Re: Why do so few mail providers support Port 587? Mikael Abrahamsson (Feb 26)
- Re: Why do so few mail providers support Port 587? Adrian Chadd (Feb 15)
- Re: Why do so few mail providers support Port 587? Bob Martin (Feb 15)