dmz mail relay configuration

Unanswered Question

I'm trying to setup a smtp relay server in a DMZ and am having trouble figuring out what I need to do to allow it to relay mail to the inside. The mail relay will be and the Exchange server on the inside is I've got traffic getting to the relay server, but can't get my head around what I need to do to get the traffic inside. I've read that I need to NAT the traffic, but I'm not sure why I would need to other than to hide the internal IP. If I just use an inbound acl on the DMZ that says:

permit tcp host host eq smtp

Would that work or am I missing something else

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Mon, 06/01/2009 - 10:09
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN


You don't have to hide the internal IP but unless you have no-nat control turned on then you will need either a static or a nat exemption in addition to your acl on the DMZ eg.

static (inside,dmz)

One other thing. Bear in mind if you add that acl to your dmz ie.

permit tcp host host eq smtp

then there is an implict deny at the end of the acl so if that is all there is in the acl then you would stop your DMZ servers initiating connections to the Internet. Generally speaking your DMZ acl would look like

permit tcp host host eq smtp

deny ip

permit ip any

where is the internal network and is the DMZ network.



This Discussion