ESET NOD32 ANTIVIRUS - FOR LINUX-BSD MAIL SERVER User Manual

21
case you use ipchains (resp. iptables) tool for network ltering an appropriate rules will be as follows.
Kernel 2.2.X:
ipchains-IINPUT-ptcp-s192.168.1.0/24-d0.0.0.0/025\
-jREDIRECT2525
Kernel2.4.X:
iptables-IPREROUTING-tnat-ptcp-s192.168.1.0/24--dport25\
-jREDIRECT--to-ports2525
Now all the communication arrives to the nod32smtp that can be checked in the module logging output. Note
that the port 2525 with this setting provides an open relay as nod32smtp accepts all the packets that arrive on port
2525 (including packets from outside the local network). The daemon nod32smtp forwards this trac to port 25 that
is interpreted by MTA as a local communication on the so called loop-back interface and therefore will not be rejected
by MTA rules. You can solve this problem by ensuring that all communication with port 2525 will be disabled except the
local network communication. Use following ipchains (resp. iptabels) rules to do so.
Kernel 2.2.X:
ipchains-IINPUT-ptcp-s!192.168.1.0/24-d0.0.0.0/02525\
-jREJECT
Kernel 2.4.X:
iptables-IINPUT-ptcp-s!192.168.1.0/24--dport2525\
-jDROP
Note that the BSD OS uses ipfw tools for network ltering. Thus in case of BSD OS an appropriate rules for
communication rerouting from the LAN arriving on port 25 to port 2525 will be as follows.
natd-interfacexl0-redirect_porttcp192.168.1.10:252525
where xl0 is the network interface of the server computer with IP address 192.168.1.10. To add the diverting rule
into the ipfw rewall you have to enter following rule.
/sbin/ipfwadddivertnatdallfromanytoanyviaxl0
Note that in order to have ipfw rewall and natd daemon working properly, the BSD OS kernel has to be compiled
with the options IPFIREWALL and IPDIVERT. Moreover the following options has to be written into ’/etc/rc.conf’.
gateway_enable=“YES“
rewall_enable=“YES“
rewall_type=“OPEN“
Now all the communication arrives to the nod32smtp that can be checked in the module logging output. Note
that the port 2525 with this setting provides an open relay as nod32smtp accepts all the packets that arrive on port
2525 (including packets from outside the local network). The daemon nod32smtp forwards this trac to port 25 that
is interpreted by MTA as a local communication on the so called loop-back interface and therefore will not be rejected
by MTA rules. You can solve this problem by ensuring that all communication with port 2525 will be disabled except the
local network communication. Use following ipfw rule to do so.
ipfwadddenytcpfromnot192.168.1.0/24to192.168.1.102525viaxl0
chapter 4 / Integration with E-mail Messaging System

ESET NOD32 ANTIVIRUS - FOR LINUX-BSD MAIL SERVER Specifications

General

Type	Antivirus Software
Supported Operating Systems	Linux, BSD
Email Scanning	Yes
Real-time Protection	Yes
License	Commercial
Purpose	Mail Server Protection
Antivirus Engine	ESET NOD32
Updates	Automatic updates
Management	Remote Management