Webmail protocols do NOT use port 25 (it uses HTTP/HTTPS browser protocols), but of course the mail server typically uses port 25 to communicate with the outside world.

 

So here is perhaps one way to do this (it probably has a cost):

 

At your router, lock down port 25 and shut off 465 (and lock down or disable 587, to be safe?) to the server from any machine on the LAN, while still allowing the server to communicate with the Internet on that port.

 

Pursuant to the above paragraph, also don't allow ports 465 or 587 through the firewall, from the Internet to the mail server.

 

Port 465 is for SSL, so if this is not enabled anyway on the mail server, it's not a problem.

 

Use a smarthost/outside gateway/relay host if you're not doing so already, such as Symantec email security.cloud. You then can (and should!) block inbound traffic to the mail server on port 25 EXCEPT for access to the mail server by the smarthost.

 

Comments?

 

 

 

 

 

The smarthost solution will probably  work. You need a router such as a Sonicwall or software router. Not sure if you can do this with Windows firewall.

And you need a smarthost. Also look at mail reflector from Noip.com.