Block all but specific IPs

[alnet]

Hey folks,

my Zimbra is running behind a spam relay that only deliveres pre-filtered emails. I do not need the internal av/as capabilities of Zimbra, so I deactivated that. My MX points to the spam relay, of course, my folks drop their mails in the zimbra appliance.

So I played with
zmprov mcf -zimbraMtaRestriction 'check_client_access lmdb:/opt/zimbra/conf/postfix_blacklist'

and edited the blacklist according to the usual postfix docs. However: If I only want to allow specific IPs but deny all others (no use case) does anyone know how to do this?

[axslingr]

Sounds like a job for firewall rules instead of postfix.

[alnet]

... and just how would you open port 25 for all clients using auth & using port 25 to drop off Emails while closing port 25 for all smtp servers trying to drop emails w/o auth?
Just closing port 25 is easy, keeping access to the remaining clients is the trick.

[axslingr]

Use 587 / 465 for client submission(that's what those ports are for) and only allow incoming port 25 from spam relay.

[alnet]

My admin heart totally agrees. But care to guess how much perent of all those configured clients out there across all devices default to Port 25?
Blocking 25 is not an option.