Configuring Mikrotik router to allow traffic from mail server running on LAN

Its normal to run mail server within the LAN if you have reliable power system but also because it is because is one of the best method for security of your mail server. This how to is going to explain how to configure Mikrotik router to allow traffic going and leaving the mail server which is running in the LAN.

This how to assumes the following

• X.X.X.X being your public IP,
• mail.jarasyola.co.tz being MX records of your server domain and 
• 192.168.1.200 being IP address of mail server.

The setup will have only three simple steps as below.


Step 1
Create firewall to allow inbound TCP traffic from any IP address to these ports on the server.

25 (SMTP)
110 (POP3)
143 (IMAP)
443 (HTTPS)
465 (SMTPS)
587 (Submission)
993 (IMAPS)
995 (POP3S)

I here assume access to webmail and any web access on the server is done on port 443(https) as port 80 will be used by mikrotik web access.

Copy the following on notepad and edit by changing the mail server IP (192.168.1.200) and mikrotik public IP (X.X.X.X)  and paste the following firewall rules on mikrotik terminal.

/ip firewall nat
add action=dst-nat chain=dstnat comment="Email server port forwarding" \
    dst-address=X.X.X.X dst-port=25 protocol=tcp to-addresses=\
    192.168.1.200 to-ports=25
add action=dst-nat chain=dstnat dst-address=X.X.X.X  dst-port=22 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=22
add action=dst-nat chain=dstnat dst-address=X.X.X.X  dst-port=110 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=110
add action=dst-nat chain=dstnat dst-address= dst-port=143 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=143
add action=dst-nat chain=dstnat dst-address=X.X.X.X  dst-port=443 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=443
add action=dst-nat chain=dstnat dst-address=X.X.X.X  dst-port=465 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=465
add action=dst-nat chain=dstnat dst-address=X.X.X.X  dst-port=587 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=587
add action=dst-nat chain=dstnat dst-address=X.X.X.X  dst-port=993 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=993
add action=dst-nat chain=dstnat dst-address=X.X.X.X  dst-port=995 \
    protocol=tcp to-addresses=192.168.1.200 to-ports=995

Step 2
Create DNS redirect to allow creating static DNS entry for the server for local access

Copy and paste the following in the terminal.

/ip firewall nat
add action=redirect chain=dstnat comment="Dns redirect" dst-port=53 protocol=\
    udp to-ports=53
add action=redirect chain=dstnat dst-port=53 protocol=tcp to-ports=53

The setting above will force all dns entry being replied by router before being redirected to provider DNS server.

Step 3
Create the static entry for mail server MX records, so that traffic within the LAN should not be redirected to public IP but going direct to mail server local IP.
Copy and paste the following in mikrotik terminal and change only mail server IP and domain MX records to reflect your mail server.

/ip dns static
add address=192.168.1.200 name=mail.jarasyola.co.tz

That's all, the server will work perfectly within your LAN, to avoid blacklist to spam generated by other users in the network you should block port 25 not being used by other computers in the network for sending unauthorized emails, the howto is found here.

Blocking rogue mail server from LAN using Mikrotik

Rogue mail server is any unauthorized mail server which can be used to send emails usually SPAMS. These are mostly compromised computers in the network which are used by spammers via your public IP's to send SPAM to the rest of the world. The main problem of this is your public IP will be frequently listed in world blacklist database and blocking good operation of legitimate mail servers running within your network.
If you're running mail server inside your LAN its good practice to create a firewall that will allow only your mail server IP to send and receive emails and blocking the rest of IP's.
In mikrotik this can be done by simple 3 firewall lines, the firewall lines are below.

Copy and paste the following on mikrotik terminal.

/ip firewall filter
add chain=forward comment="Allowing mail server" dst-port=25 out-interface=\
    ether1-gateway protocol=tcp src-address=192.168.1.200
add chain=forward comment="Allowing mail server" dst-address=192.168.1.200 \
    dst-port=25 in-interface=ether1-gateway log=yes protocol=tcp
add action=drop chain=forward comment="Blocking Spammers" dst-port=25 log=yes \
    protocol=tcp

The first two lines of the firewall allow traffic going and leaving the mail server where the last line block any traffic leaving the LAN via port 25 which which is mainly used to mail traffic.
In this firewall 192.168.1.200 is mail server IP so if you're copy and pasting that firewall you should change that IP.
After that sit and relax because if you find your public IP being blacklisted is because the spam is originated from your mail server and that is easy to troubleshooting if the server is well configured and secured.

Controlling user bandwidth by Firewall and Queues in Mikrotik Router

Heavy downloads and uploads has become problems in most of networks now days, as users are running different bandwidth hungry applications such as peer-to-peer, video downloads etc which lead to slow down of whole network because of only one single user or some few users who are doing heavy downloads/uploads.
This lab is going to show you how to limit all users to specific speed in three simple steps using firewall mangle rules and queues in mikrotik router, in this lab am going to limit all users at 1Mbps bandwidth speed, which means that will be maximum speed reached by each particular user in the network despite available bandwidth.

Below are steps

a.  Create a customized queue types with preferred speed for each individual user,

Command:

/queue types

add name="PCQ_Download" kind=pcq pcq-rate=1M pcq-limit=50 
     pcq-classifier=dst-address pcq-total-limit=2000 pcq-burst-rate=0 
     pcq-burst-threshold=0 pcq-burst-time=10s pcq-src-address-mask=32 
     pcq-dst-address-mask=32 pcq-src-address6-mask=64 pcq-dst-address6-mask=64 

add name="PCQ_Upload" kind=pcq pcq-rate=1M pcq-limit=50 
     pcq-classifier=dst-address pcq-total-limit=2000 pcq-burst-rate=0 
     pcq-burst-threshold=0 pcq-burst-time=10s pcq-src-address-mask=32 
     pcq-dst-address-mask=32 pcq-src-address6-mask=64 pcq-dst-address6-mask=6


By winbox or web config:

Go to Queues-Queue Types, and add , example below is for PCQ_Download

b. Mark all the packet, which is to be queued for specific speed

Command:

/ip firewall mangle
 add chain=prerouting action=mark-packet new-packet-mark=user_download 
     passthrough=yes in-interface=wlan1-gateway 

 add chain=prerouting action=mark-packet new-packet-mark=user_upload 
     passthrough=yes in-interface=ether1-local

Note am marking download packets from wan interface in which for my case is wireless interface because am using wireless radio as a router, also am marking upload from LAN interfaces in which from this lab is ether1-local

By winbox or web config:

Go to ip firewall mangle , and add, example below is for user dowload

c. Finally create a tree queue for limiting every individual user speed

Command:

/queue tree
  add name="UserDownload" parent=global packet-mark=user_download 
     limit-at=0 queue=PCQ_Download priority=8 max-limit=0 burst-limit=0 
     burst-threshold=0 burst-time=0s 

  add name="UserUpload" parent=global packet-mark=user_upload limit-at=0 
     queue=PCQ_Upload priority=8 max-limit=0 burst-limit=0 
     burst-threshold=0 burst-time=0

By winbox or web config:

Go to queue tree , and add, example below is for user dowload

You're done, below is the torch output before and after settings

Before:

Single user was able to reach 2.2Mbps

After:

All users are limited at 1Mbps as per our setting

Hope it help someone, drop me a comment, if you face difficulties implementing any of the step.

Cheers!