republican-creole
Search:  

 
 
   News
newer
story category Comcast Blocking Port 25/TCP Inbound?
(old news - 04:25PM Monday Apr 09 2007)
tags: business · spam · networking
Port 25/tcp is used for SMTP, the outgoing mail protocol, and is often blocked by ISPs to cut down on spam (whether intentional or due to infection). The block prevents users from sending outgoing mail via any third party mail-hosting services. We've watched inbound port 25 blocking shift from a scattered practice to an industry standard over the last few years.

The tactic is generally a good idea. It only causes trouble when the ISP fails to clearly inform users of the change, allowing them to employ fairly easy workarounds. Other ISPs take that tactic a bit further, blocking inbound port 25 traffic. Some claim this less common tactic is usually done to prevent users from running a mail server, forcing them to upgrade to a more substantive business account for the privilege.

ISPs say this isn't the case; blocking inbound port 25 traffic really helps them keep inadvertent open relays to a minimum, and therefore helps keep their IP blocks off of blacklists. Comcast started selective blocking of outbound port 25 traffic back in 2004. Some Comcast customers in our forums say it looks like Comcast may now be blocking inbound port 25/tcp traffic in some instances. We've contacted Comcast for confirmation but have not yet received a response.

Related:
  1. My DLink Router Is Spamming Me
  2. Metrocast Offers Fiber To The Home
  3. Comcast Still Fighting FCC Throttling Sanction
  4. Sandvine: P2P Now Just 20% Of Internet Use
  5. AT&T: No, We Didn't Misconfigure Our 3G Network
  6. There's Still No Evidence That Metered Billing Is Necessary
  7. Broadband Over Powerline's Poster Child Pulling The Plug
  8. ICANN Slams DNS Redirection
Forums » Comcast Blocking Port 25/TCP Inbound?
view: topics flat text 
Post a:
page: 1 · 2
fiberguy
My views are my own.
Premium
join:2005-05-20

I don't see the problem

"Some claim this less common tactic is usually done to prevent users from running a mail server; forcing them to upgrade to a more substantive business account for the privilege. "

So what's the problem? Running a mail server is not "typical residential use" and is something more typically seen in business.

I don't see a problem with this if it's cutting down on spam.. and simply enough, the network is the property of the ISP and if they want to block inbound 25, then that's the way it is.
--
"Complaining is the least path of resistance for the self-reitchous and lazy ... those who also never take the time to point out a good fortune when the opportunity presents itself. It says a lot about one's moral character." - Unknown
ke4pym

join:2004-07-24
Charlotte, NC
·Verizon BroadbandA..
·Packet8
·RoadRunner Cable

Re: I don't see the problem

said by fiberguy See Profile :

I don't see a problem with this if it's cutting down on spam.. and simply enough, the network is the property of the ISP and if they want to block inbound 25, then that's the way it is.
Well, see, here's the rub. While the network may be the property of the ISP, my monthly subscriptions help pay for their bills. If they're going to make a change on the network I pay for, then I expect them to, at the very least, tell me there's been a degredation in my service. Especially if it is something I've been using for 10 years.

Then the ball is in my court to stick with it, pay for a higher tier (which is crazy) or find a new ISP.

I'd expect the same notification that channels are being deleted from my TV lineup.

How would you like coming home and finding a quarter of the channels you love gone - and oh, by the way, they didn't drop the price you were paying for...

Oh, and they should probably not use "Unlimited" -anywhere- in their marketing if they're limiting the ports you can, and cannot use, too.
RadioDoc
58ef2c0
Premium,ExMod 2000-03
join:2000-05-11
·AT&T Midwest

Re: I don't see the problem

said by ke4pym See Profile :

How would you like coming home and finding a quarter of the channels you love gone - and oh, by the way, they didn't drop the price you were paying for...
You forgot the second part of that equation: You can have the channels back if you convert to a "professional" rate at twice the cost, which gets you back to where you were in the first place.

Cable math, you know.
--
Toolmaster of La Grange.
fiberguy
My views are my own.
Premium
join:2005-05-20

Here is the rub back.. you were never allowed to run a public server on their network to begin with.. so where was your service degraded?

And, if you say that it was, at one time, allowed, then you need to pay attention to the terms of service updates that you get from time to time that you agreed to pay attention to.

But since you are in Charlotte, NC and have Time Warner Cable, I don't see how this issue in Comcast is related to you anyway.
--
"Complaining is the least path of resistance for the self-reitchous and lazy ... those who also never take the time to point out a good fortune when the opportunity presents itself. It says a lot about one's moral character." - Unknown
ke4pym

join:2004-07-24
Charlotte, NC
·Verizon BroadbandA..
·Packet8
·RoadRunner Cable

Re: I don't see the problem

said by fiberguy See Profile :

But since you are in Charlotte, NC and have Time Warner Cable, I don't see how this issue in Comcast is related to you anyway.
Maybe because this thread is in on the front page of this site and not in a Comcast dedicated forum?
RadioDoc
58ef2c0
Premium,ExMod 2000-03
join:2000-05-11

Re: I don't see the problem

Don't bother. To him, facts are a nuisance.
--
Toolmaster of La Grange.

phattieg

join:2001-04-29
Winter Park, FL
·Verizon Wireless B..
·Sprint Mobile Broa..

Re: I don't see the problem

said by RadioDoc See Profile :

Don't bother. To him, facts are a nuisance.
Umm, the shoe fits... Wear it real good... The point made is a good one. In the TOS, you are not permitted to use one. Back in 2000, when TWC shut down port 25 on me, I read the TOS before I called, and found I had no grounds to complain. I honestly wish that Comcast would disconnect customers who called up complaining that "their server" is not accepting outside connections, which is a blatent violation of the TOS. It would be great saying "I'm sorry if you don't read that junk (TOS), maybe you should before you call up yelling at us about YOUR server". I have violated the TOS, in a couple of ways, but I wouldn't go ballistic if I had some port blocks in place, simply because there is other ways around it. The open minded person keeps their service.

Reply all you want, but until you can HONESTLY respect the fact that it is the ISP's network, not yours, even if you pay $1 million a month, its not yours, and you have a TOS still stuck to it. TOS is like the law, they can let ya slide, but if it comes down to it, you can be locked down too.
--
SIPPhone/Gizmo # 17476200648 / PIMPNET Chatline / Ran by Asterisk & Slackware 10.1.
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

said by fiberguy See Profile :

So what's the problem? Running a mail server is not "typical residential use" and is something more typically seen in business.
There is no reason why that should be so. Of course, if it is against the ISP AUP/TOS to run a mail server, blocking inbound port 25 does facilitate enforcement.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
fiberguy
My views are my own.
Premium
join:2005-05-20


1 edit

Re: I don't see the problem

You are right in both senses.. HOWEVER, there are a lot of residential users, that because they don't know what they are doing, they are running open relays which does cause a problem for the network.

The way I see it.. these residential ISPs have a couple of options..

1) Block the use - most do.

2) Block port 25 by default but allow it to be opened upon request and only if they scan and test the port for open relays - REGULARLY. I'd also see a fair fee to unblock the port for the time they have to put into administering the program.. since it's a residential service, they aren't in the business of performing duties that they would normally do on the business side to which they would most certainly charge for.

3) Block when a complaint is issued.

I do agree that mail servers are harmless, for the most part. The same amount of mail is going to go out, typically, if they were to use the ISP's mail server UNLESS they are allowing others to use that same server in which I'd support the ISP to block.
--
"Complaining is the least path of resistance for the self-reitchous and lazy ... those who also never take the time to point out a good fortune when the opportunity presents itself. It says a lot about one's moral character." - Unknown
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

Re: I don't see the problem

said by fiberguy See Profile :

You are right in both senses.. HOWEVER, there are a lot of residential users, that because they don't know what they are doing, they are running open relays which does cause a problem for the network.
I see a lot of connection attempts to my server from Comcast residential IP address space. And I get a lot of 'bot spam to my ISP mail account from Comcast residential IP address space. I have yet to see an open relay in that mix.
The way I see it.. these residential ISPs have a couple of options..

1) Block the use - most do.

2) Block port 25 by default but allow it to be opened upon request and only if they scan and test the port for open relays - REGULARLY. I'd also see a fair fee to unblock the port for the time they have to put into administering the program.. since it's a residential service, they aren't in the business of performing duties that they would normally do on the business side to which they would most certainly charge for.

3) Block when a complaint is issued.

I do agree that mail servers are harmless, for the most part. The same amount of mail is going to go out, typically, if they were to use the ISP's mail server UNLESS they are allowing others to use that same server in which I'd support the ISP to block.
Those are good steps for ISPs to follow.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

devicemanage
Premium
join:2002-03-16
Chalfont, PA
·Comcast
·Vonage
·Verizon FIOS

Re: I don't see the problem

I also agree - they took me down over the weekend. Came off that I was sending out large amounts of spam - that is so much bs. No open relay, no virus's - nothing!

All my logs are on and I check them regularly. I see people banging on my ftp ports like crazy, trying to back track on url's - looking for some way in. In a way I can understand why they do this - it looks like Comcasts ip blocks are targets or port scans. I can tell you one thing, my logs are showing many attempts from over seas - Germany, China, Russia to name a few. There are ways around this anyway!!!
--
»www.devicemanager.net

powned

@charter.com

I see plenty of of problem, I don't run a mail server, however, I would like to connect to an external mail provider for my domain using Outlook rather than theeir webmail interface. That requires 25/110 ports to be accessible through the ISP network. Knology is also doing this, so Comcast is not the only one.

All one asks for is that the terms of service be clearly stated. Saying that you cannot run a mail server does not cover my above stated problem.

So byte me
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

Re: I don't see the problem

said by powned :

I see plenty of of problem, I don't run a mail server, however, I would like to connect to an external mail provider for my domain using Outlook rather than theeir webmail interface. That requires 25/110 ports to be accessible through the ISP network. Knology is also doing this, so Comcast is not the only one.
Where is it written in stone that you must have access to outbound port 25 to use email?

I use:

smtp.aim.com
smtp.aol.com
smtp.gmail.com
smtp.gmx.net
smtp.mail.yahoo.co.jp
smtp.mail.yahoo.com
smtp.mail.yahoo.com.au
smtp.myrealbox.net

None of them require outbound port 25.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

McDonuts

@nctv.com
110 is still open, so you can receive e-mail as usual. And you just have to change your SMTP to Comcast's server (smtp.comcast.net), and it will relay it for you. I helped my friend do that this morning for his company's domain.

nixen
Rockin' the Boxen
Premium
join:2002-10-04
Alexandria, VA
·Cox HSI
·Speakeasy

Re: I don't see the problem

said by McDonuts :

110 is still open, so you can receive e-mail as usual. And you just have to change your SMTP to Comcast's server (smtp.comcast.net), and it will relay it for you. I helped my friend do that this morning for his company's domain.
port 110 has nothing to do with receiving mail. All it has to do with is being able to download email (while sending your login credentials in cleartext - hooray!).
--
Everyday, thousands of new cars are delivered to their new owners with poorly-selected radio station presets.

phattieg

join:2001-04-29
Winter Park, FL
·Verizon Wireless B..
·Sprint Mobile Broa..

said by powned :

I see plenty of of problem, I don't run a mail server, however, I would like to connect to an external mail provider for my domain using Outlook rather than theeir webmail interface. That requires 25/110 ports to be accessible through the ISP network. Knology is also doing this, so Comcast is not the only one.

All one asks for is that the terms of service be clearly stated. Saying that you cannot run a mail server does not cover my above stated problem.

So byte me
Well, port 25 when used on YOUR computer, is for OUTBOUND communication from YOUR machine to THE WORLD. What you're saying has nothing to do with this. You can still SEND mail. Comcast just won't let an outside connection connect to your port 25. So if you made a mail server, and then tried to setup Outlook Express at another persons house so you could send mail, you would get a "timeout" error in Outlook Express, because Comcast would block you from reaching your machine via port 25..
--
SIPPhone/Gizmo # 17476200648 / PIMPNET Chatline / Ran by Asterisk & Slackware 10.1.
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

Re: I don't see the problem

said by phattieg See Profile :

Well, port 25 when used on YOUR computer, is for OUTBOUND communication from YOUR machine to THE WORLD. What you're saying has nothing to do with this. You can still SEND mail. Comcast just won't let an outside connection connect to your port 25. So if you made a mail server, and then tried to setup Outlook Express at another persons house so you could send mail, you would get a "timeout" error in Outlook Express, because Comcast would block you from reaching your machine via port 25..
Port 25 is for "mail transport". What you are describing is "message submission". For a long time, ISPs, and mail clients, were set up to use port 25 for "message submission". But it is becoming clear that email service providers need to implement a "message submission" port.

Look up RFC 2476.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

devicemanage
Premium
join:2002-03-16
Chalfont, PA
·Comcast
·Vonage
·Verizon FIOS

My isp has actually blcoked port 25 and now authentication is required on 587 - I think they have me locked down pretty tight. Is there any way around this?
--
»www.devicemanager.net
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

Re: I don't see the problem

said by devicemanage See Profile :

My isp has actually blcoked port 25 and now authentication is required on 587 - I think they have me locked down pretty tight. Is there any way around this?
Why is authenticating on port 587 a problem? That is the way of the future.

But, no. There is no way around it. If your ISP won't let you use port 25 outbound, you would have to hack their network. Surely that is forbidden.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

devicemanage
Premium
join:2002-03-16
Chalfont, PA

Re: I don't see the problem

Just a problem for me! But I can't agree more...
--
»www.devicemanager.net
atom_man

join:2007-02-13
m5a2b4

If residential subscribers aren’t allowed to run services, why are they only stopping at blocking port 25? If you eliminate everything that requires more then just a client.. What incoming ports does a residential subscriber really need? Sure.. residential users wouldn’t able to connect to their Fax machines, VPN’s, Remote desktops, linux boxes, SQLs, X Server’s, Sling Boxes, accept incoming calls and won’t be able to host computer games… But if they have a problem with that, why should they complain? Isn’t it their own fault for trying to do such things in the first place?

My point is that game servers, communications servers, file servers, database servers and web servers are part of everyday residential use. Telling your customer to go by a ‘blade server’ and co-host it somewhere is rather silly, and very expensive. (100$/month for co-host, 50$/month for cable) so a user can access their sling box from work?

Having a ToS that says "not allowed to run servers" is almost like another ToS I’ve seen which says “not allowed to connect to remote systems”. After all, what good is the internet is if you can’t connect to remote systems?
plat2on1

join:2002-08-21
Hopewell Junction, NY
clubs:

does

one unconfirmed report really warrant a front page news article?

RideRed
Vista needs a popup blocker for Vista
Premium
join:2005-06-18
USA

1 edit

Re: does

Just thinking the same thing. Must be a slow news day and Karl ran out of Bush sucks articles.

Karl Bode
News Guy
join:2000-03-02
We're always looking for contributions if the selection isn't to your liking.

battleop

join:2005-09-28
00000

It's about damn time.

This will lead to support calls from my hosted customers but it's about damn time Comcast did something. Just have users switch to port 587 or use smtp.comcast.net as the outgoing mail server.

tenpin784
I Went To The Dark Side?

join:2001-03-30
New Durham, NH

Makes sense

On a residential account, I think they should block 25, cause most users think they know what they are doing, then they end up misconfiguring, next thing you know, bam, open relay.

This goes along the lines of blocking inbound 80 and 21 too. Most ISPs wont let you run servers on residential accounts.
--
Dream as if you'll live forever, live as if you'll die today.

Disclaimer: These are MY comments, my employer cant be held responsible.

JamesPC

join:2005-10-12
Orange, CA

Re: Makes sense

That would be bullshit if they block port 21. Even blocking inbound 80 is crap. Change ISP if they do this nonsense.
RadioDoc
58ef2c0
Premium,ExMod 2000-03
join:2000-05-11
·AT&T Midwest

said by tenpin784 See Profile :

This goes along the lines of blocking inbound 80 and 21 too. Most cable ISPs wont let you run servers on residential accounts.
There, fixed it for you. Not every ISP thinks so little of its customers.
--
Toolmaster of La Grange.
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

said by tenpin784 See Profile :

Most ISPs wont let you run servers on residential accounts.
Fortunately, my residential ISP does not explicitly prohibit servers, nor does it block common inbound server ports (just those pesky NetBIOS ports).
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

tenpin784
I Went To The Dark Side?

join:2001-03-30
New Durham, NH
I didnt mean they actively stop you, they just have it written in their TOS so if you get caught, they have a fighting chance against you
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC


1 edit

Re: Makes sense

said by tenpin784 See Profile :

I didnt mean they actively stop you, they just have it written in their TOS so if you get caught, they have a fighting chance against you
RadioDoc is covered by the same ISP as I...

»helpme.att.net/article.php?item=441
»edit.client.yahoo.com/cspcommon/···page=tos

If you can find the explicit prohibition, please point it out. For the first link you may be required to choose a domain. Any in the drop down list will suffice. And do select "DSL", as well.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

tenpin784
I Went To The Dark Side?

join:2001-03-30
New Durham, NH
ok, so your one isp, wow

i said most.........
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

Re: Makes sense

at&t Yahoo! HSI, Speakeasy, DSL Extreme (not the BS speed tier!), Embarq...I can't find an explicit prohibition in the Qwest DSL TOS, either. Verizon stands out as the only U.S. DSL provider which explicitly prohibits running servers on residential connections. That I can verify.

Of those, AT&T is within half a million subs of equal to Comcast in size.

Modify your statement to, "most cable and dial-up providers", and you will be more accurate.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

nixen
Rockin' the Boxen
Premium
join:2002-10-04
Alexandria, VA
·Cox HSI
·Speakeasy

ToS Enforcement

If you ToS says "not allowed to run servers", it only makes sense that an ISP go after the low-hanging fruit by blocking any and all inbound connections to well-known service ports (FTP, HTTP/HTTPS, SMTP, etc.). Of course, if they want to be real ball-busters about it, they'd do packet inspection, too, to get the people that were running on "off" ports. That takes money, though, and they can do 90% ToS enforcement without the expense of packet inspection.
--
Everyday, thousands of new cars are delivered to their new owners with poorly-selected radio station presets.

See 7 replies to this post

JamesPC

join:2005-10-12
Orange, CA

Change

I run a mail server for about 1,000 people. Of those people about 25% have to use the ISP outgoing mail server. Mostly for the DSL companies but like I thought the Cable Co's are getting into it more. They need to let there customers know of the change.
NormanS
Premium,MVM
join:2001-02-14
San Jose, CA
·Pacific Bell - SBC

Re: Change

said by JamesPC See Profile :

I run a mail server for about 1,000 people. Of those people about 25% have to use the ISP outgoing mail server. Mostly for the DSL companies but like I thought the Cable Co's are getting into it more. They need to let there customers know of the change.
If you configure your server to use one of the Message Submission ports, your users wouldn't have to use their ISP mail servers.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

Kniveton

join:2001-09-20
San Francisco, CA

Thank god I have DSL

and can run my own mail, web, and imap servers without my ISP interfering with my traffic.

I couldn't care less for my ISP's email, web hosting, etc. Just route my packets to their destination, send me my packets, and everything will be fine.

See 23 replies to this post
jdmatl

join:2000-04-27
Deerfield Beach, FL

100% BS-Not block outbound TCP 25

sent email today outbound tcp/25 to my mail server at hosted provider.

None was blocked, went out with no issues.

See 9 replies to this post
mrweirdo

join:2004-09-12
Roseville, CA

:/

the day Comcast blocks my outgoing mail to my hosts mail server which hosts my domain is the day I drop Comcast and switch to a different isp.

See 10 replies to this post

Loker
Premium
join:2004-07-11
Fargo, ND
clubs:

One Claim?

I do not necessarily think it is a bad idea to block port 25 but is one unsubstantiated claim really worth calling it news? I mean with one claim its barely a rumor...
--
"While preceding your entrance with a grenade is a good tactic inQuake, it can lead to problems if attempted at work." -- C Hacking

Cabal
Premium
join:2007-01-21
Boston, MA

Re: One Claim?

No problems here.

$ telnet 71.232.XXX.XXX 25
Trying 71.232.XXX.XXX...
Connected to 71.232.XXX.XXX.
Escape character is '^]'.

None outgoing either.
--
Interested in open source engine management for your Subaru?

nixen
Rockin' the Boxen
Premium
join:2002-10-04
Alexandria, VA
·Cox HSI
·Speakeasy

Re: One Claim?

said by Cabal See Profile :

No problems here.

$ telnet 71.232.XXX.XXX 25
Trying 71.232.XXX.XXX...
Connected to 71.232.XXX.XXX.
Escape character is '^]'.

None outgoing either.
When it's fun is if they transparently proxy you. So, the only way you notice that the port has been messed with is if you pay attention to the SMTP greeting/banner upon connection.
--
Everyday, thousands of new cars are delivered to their new owners with poorly-selected radio station presets.

JamesPC

join:2005-10-12
Orange, CA

Be a PRO

What are you guys doing running mail servers on residential broadband lines??? Word to the wise... rent a rack in a server farm and buy your own blade server.

See 7 replies to this post

antiphishing
Phishing Scam Terminator
Premium
join:2004-06-09
Wilkes Barre, PA

Block port 25 , Use Port '465' SSL


Comcast and the problem of Spam
Don't you just love Comcast as a internet provider, it's a either bandwidth caps or blocking of email ports.

This is a old story in which Comcast continues to implement a block against email from being sent through port 25 to stop abuse of their equipment.

I try to send all of my email through port 465 (SSL) for security reasons. If more ISP's moved more of their customers
to a more secure port like 465 then it would help with the problem of mail relaying.
--

Specializing in "takes downs" of phishing and advance fee scams
Send your Phishing/Advance fee scams to: phish@antihotmail.com
»/profile/1021645

See 6 replies to this post

TraumaJunkie
Premium
join:2004-03-05
Knoxville, TN

They are blocking SMTP Port 25

But only after the account has been identified and spewing forth tons of garbage and spam. You can then use webmail or set up a client using SPA and the instructions are clearly found on the .net website FAQ about email. I use it because when I travel on business I don't have to worry what service the hotel or ofice I am uses I can use my Comcast email server to send mail easily from my Outlook client.
--
I'm not really sure what I am doing, but I'm doing it anyway!

pkarlos_76

join:2004-08-24
Edmonton, AB

DUhhh

They've been doing this since 2004, at least that or longer, whats the big news about this. Get a life ppl. They block all INBOUND (off their network) to fight SPAM. Of course we all know that if they allowed it you would be whining about ht eamount of SPAM. Now go find the alternate port that comcast allows you to use when trying to access your mail via another provider that requires authentication.

nswint
Who Built The Ark?
Premium
join:2001-11-17
Union City, GA
clubs:

SMTP Redirection

It's all about SMTP Redirection

»www.rollernet.us/

Zaber
When all are gone, there shall be none

join:2000-06-08
Cleveland, OH
clubs:
·Expedient
·XO COMMUNICATIONS
·AT&T Midwest

Confused

ISPs say this isn't the case; blocking inbound port 25 traffic really helps them keep inadvertent open relays to a minimum, and therefore helps keep their IP blocks off of blacklists.
I must be missing something here, if the ISPs block outbound TCP25 how can their IP get blocked, even if there is an open relay, any mail sent out doesn't get through anyway?

While I do not agree with the outbound 25 block, it does make since. I do not, however, understand the point of an inbound block unless it is to make someone upgrade to a higher "business" tier.
--
Give a man a fish and he eats for a day, teach a man to fish and he will feed himself for a lifetime
kpatz
MY HEAD A SPLODE
Premium
join:2003-06-13
Manchester, NH

If they really want to do it right...

1. They should block 25 outbound only, and provide the option to unblock it by request.
2. Offer a power-users tier that allows servers and doesn't have ports blocked. I would gladly pay extra for such a tier.

IMHO, port blocking should only be employed in cases where the port shouldn't be open to the internet to begin with, such as NetBIOS, SMB, etc. 25 is used by a MAJOR Internet protocol, and blocking it reduces the functionality of my INTERNET connection. It's like the phone company blocking your phone from placing or receiving calls from a particular area code or exchange.

An ISP is an Internet SERVICE Provider. Their job is to provide a connection to the Internet. Blocking of ports is not an ISP's job. If you want ports blocked, there's a gadget called a firewall that you can use.

The bottom line is, I want to control what ports are open and which ones are blocked. Not my ISP. Where I am, my only choices are Comcast and Verizon DSL. If Comcast takes away port 25, I'll have to live without my mail server, or switch to DSL, which is a lot slower and has its own problems (PPPOE etc.)
--
Windows Vista has detected that your mouse was moved. In order to enhance your user experience, Vista needs to contact Microsoft to re-activate the software. Please make sure you are connected to the Internet, have your credit card handy, then click OK.

Tripp

@bellsouth.net

If outbound is blocked, inbound is largely unnecessary

"Other ISPs take that tactic a bit further, blocking inbound port 25 traffic. Some claim this less common tactic is usually done to prevent users from running a mail server"
[...]
"ISPs say this isn't the case; blocking inbound port 25 traffic really helps them keep inadvertent open relays to a minimum, and therefore helps keep their IP blocks off of blacklists."

There's a bit of irony in that. If an ISP blocks outbound port 25, none of its subscribers can spam other ISP's inbound port 25 (MX). Since they can't spam direct to MX, it really doesn't matter so much if they're running an open relay.

If you block outbound port 25, you really don't need to worry so much about inbound port 25 abuse. There are still good reasons to do so (e.g. the victim could be chain relaying on another port, inbound port 25 eats up some bandwidth, and most customer PCs running open relays on port 25 aren't aware of it and probably otherwise unsecured).

Tripp
ewm0826

join:2000-05-23
Raynham, MA

Not Blocked Here

I am running a MailEnable server on my Comcast cable service, although I don't use it for daily email. Inbound and outbound ports are not blocked here. Mostly I just run it because I can. I check it each day and it's locked down; no relays going on here although the logs show how the spam vermin try to use it every day.

I initially tried to use it for occasional email but found that Comcast blocks email from its own network! And, the dynamic IP block I'm on is in nearly every reputable black list. Dynamic IPs are a source of spam as we all know.
--
===========
Ed

Skink

@comcast.net

Blocked Here

I had no open relay,,, I was not spamming... I got no warning and bang 25 shut both ways... what they did was target my mail server...
jayunsplanet

join:2007-07-09
Parkville, MD

Comcast Blocking Port 25 is extremely aggravating

Wow. After a little over 2 years of pretty good service I get the Port 25 block POS business. I will admit that I do run a Exchange email server that all my @gmail, @comcast @other domains forward to. I've been doing this since I started my service. (First Comcast High speed internet w/ cable. Now HD Digital cable) I send, at most, 3 emails from my server a day. (I usually respond to emails from the actual account they are received in using web mail)

I only use it as a central place to read all my emails and easily save them and have control over my mailbox. Why did they just enact this demented rule now? This is seriously extremely annoying. Unless I can find some other way to run Exchange on another port or some other cleaver masking I'm SOL.

I can understand where Comcast is coming from; having to deal with the scum of the earth scammers, but for your average person (well average server running person) who just wants a simple way to READ their emails in one place, it's overkill. Worse, is now the other members in my house can't send email on Port 587. Only receive it. I'll have to look into the authentication setting.

I wonder if Verizon DSL blocks Port 25. I wouldn't mind DSL and it's upload speeds either... Hummm.

Time to go on the hunt on a workaround, another ISP, or a super great internet email provider that has all the features of my own Exchange system...

Verizon FiOS should be making it's way to my neighborhood sometime in the next year...
Forums » Comcast Blocking Port 25/TCP Inbound?page: 1 · 2


Monday, 30-Nov 08:39:04 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.