Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

AWS outbound port 25 restriction

0

We have lambda functions that generate emails and send to our internet mail exchangers on port 25. We have successfully applied to AWS and removed the outbound port 25 restriction on these lambdas and emails were being sent successfully. We have now changed the outbound routing of these messages to travers a different Transit Gateway, AWS Network Firewall deployment and NAT gateways in a different AWS account and it seems that outbound port 25 traffic is now being blocked. So even though the source lambdas remain as-is and have already had the outbound port 25 removed, do we also have to apply to have the restriction removed in the account hosting the networking infrastructure we are now routing the messages across?

Topics
ComputeNetworking & Content DeliverySecurity, Identity, & Compliance
Tags
Amazon VPCAWS Network FirewallAWS LambdaNetworking & Content Delivery
Language
English

asked a year ago282 views

3 Answers
1

I really think the solution is: don't use port 25; use ports 587 (STARTTLS) or 465 (TLS Wrapper). <voice=gen-a>Port 25 is like so last century</voice>

As per the EC2 User Guide, there is a Restriction on email sent using port 25: "Amazon EC2 allows outbound traffic over port 25 only to private IPv4 addresses. Traffic over port 25 is blocked to public IPv4 addresses and IPv6 addresses."

I think that there's no longer any excuse not to encrypt everything, all the time; it's free, it's easy. but if you Really, Really, Really need to use port 25, then Yes, you need additional exception(s).

Even though the source lambdas didn't change, the Port 25 traffic is Blocked because the following traffic is dropped: Inter-VPC TCP packets on port 25

You may need an exception for all intermediate accounts as well, ie. if you have 3 separate Accounts: 1/ acct where the Lambda resides; 2/ acct for inspection; 3/ acct where traffic egresses to the internet.

Can you provide more context on Why you just Have to use port 25?

AWS

answered a year ago

  • Prys
    a year ago

    Thank you weinsran for taking the time to respond. For context, the mail server is provided by a 3rd party. It is also the internet mail exchange for our organisation and therefore absolutely must accept connections on port 25, for mail server-server comms. But you're right, we should enquire if we could connect using ports 587 or 465 which is the norm now for client-server comms. Also, all our emails are encrypted using starttls command over the established connection.

0
Accepted Answer

The outbound TCP/25 (SMTP) approval is (more or less) based on the Elastic IP that is used. Because you've changed which IP you're using (due to the change in NAT Gateway) you need to get approval again.

EXPERT

answered a year ago

AWS
EXPERT

reviewed a year ago

0

Hi,

The way to go is to use Network Analyzer: it will tell what you can and cannot access with your current settings.

See https://docs.aws.amazon.com/vpc/latest/network-access-analyzer/what-is-network-access-analyzer.html

Best,

Didier

EXPERT

answered a year ago

  • Prys
    a year ago

    Thank you Didier. Does AWS Network Analyzer work across different AWS accounts?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content