Restricting SMTP Access with ACLs on Citrix NetScaler

Thu, 01 Oct 2015 00:00:00 +0000

I had to configure a Citrix NetScaler (version 10.5) to load balance SMTP for an organisation that relayed mail through Microsoft’s smart host. Only specific source IP addresses should be able to reach port 25.

This is all done from the CLI. In the GUI, the same settings are under Configuration → System → Network → ACLs.

In this example, the permitted senders are 1.1.1.1 and 2.2.2.2.

Create the ACLs #

cli

> add ns acl ALLOW-SMTP-1.1.1.1 ALLOW -srcIP = 1.1.1.1 -destPort = 25 -protocol TCP -priority 10
 Done
> add ns acl ALLOW-SMTP-2.2.2.2 ALLOW -srcIP = 2.2.2.2 -destPort = 25 -protocol TCP -priority 20
 Done
> add ns acl RESTRICT-SMTP-ALL DENY -srcIP = 0.0.0.0-* -destPort = 25 -protocol TCP -priority 50
 Done

There’s no implicit deny or permit at the end of a NetScaler ACL list, so you need the explicit DENY rule to block everyone else. Lower priority numbers are evaluated first.

Smtp on vlan51

Restricting SMTP Access with ACLs on Citrix NetScaler

Create the ACLs #