MessageLabs Email Filtering

List of MessageLabs Public Ip Address Ranges :

Subnet IP Subnet Mask
216.82.240.0 255.255.240.0     /20 216.82.240.0 – 216.82.255.255
67.219.240.0 255.255.240.0     /20 67.219.240.0 – 67.219.255.255
85.158.136.0 255.255.248.0     /21 85.158.136.0 – 85.158.143.255
95.131.104.0 255.255.248.0     /21 95.131.104.0 – 95.131.111.255
46.226.48.0 255.255.248.0      /21 46.226.48.0 – 46.226.55.255
117.120.16.0 255.255.248.0     /21 117.120.16.0 – 117.120.23.255
193.109.254.0 255.255.254.0  /23 193.109.254.0 – 193.109.255.255
194.106.220.0 255.255.254.0  /23 194.106.220.0 – 194.106.221.255
195.245.230.0 255.255.254.0  /23 195.245.230.0 – 195.245.231.255

Linux Iptables Firewall Rules :

Create a Chain :

sudo iptables -t nat -N messagelabs

!

Create a PREROUTING rule to forward port 25 to “messagelabs” chain :

sudo iptables -t nat -I PREROUTING 11 -d 195.99.136.99/32 -p tcp -m tcp –dport 25 -j messagelabs

!
Create rules in messagelabs chain to DNAT port 25 Traffic to internal host :
sudo iptables -t nat -I messagelabs 1 -s 216.82.240.0/20 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 67.219.240.0/20 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 85.158.136.0/21 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 95.131.104.0/21 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 46.226.48.0/21 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 117.120.16.0/21 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 193.109.254.0/23 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 194.106.220.0/23 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
sudo iptables -t nat -I messagelabs 1 -s 195.245.230.0/23 -p tcp -m tcp –dport 25 -j DNAT –to 172.31.10.12:25
!
!
Next Chain down the line that will be accessed is the FORWARD chain :
This will FORWARD traffic to the POSTROUTING chain where it will locally break-out to the internet.
!
sudo iptables -I FORWARD 1 -d 172.31.10.12/32 -p tcp -m tcp –dport 25 -j ACCEPT
!
!
Final chain to be accessed is the POSTROUTING chain,
where traffic is SNATed to a particular interface :
!
sudo iptables -t nat -I POSTROUTING 5 -o eth1 -s 172.31.10.12 -j SNAT –to 195.99.136.99