how to disable port 25 without firewall server 2008?

Deep78

Deep78

Expert Member
Joined
Mar 1, 2010
Messages
1,643
Reaction score
1
Location
Cape Town
Does anyone know how to disable port 25 on server 2008 without having
to use the windows firewall? having issues finding help on google with this as well!
 
What exactly is the problem and why is your server listening on port 25?
I assume you have mail services running?
If not needed, stop the services, the server will stop listening.

I am not a windows guy, so thats all I can think of :)
 
syntax said:
What exactly is the problem and why is your server listening on port 25?
I assume you have mail services running?
If not needed, stop the services, the server will stop listening.

I am not a windows guy, so thats all I can think of :)
Click to expand...

I would think the same, I don't think you can do it any other way. Either firewall or stop the service. Would need more info though, what are the circumstances and why on earth would you not want to use a firewall?
 
In the command prompt run netstat /a -n -b find Port 25 to see which exe is listening on that port, if its a service as mentioned above then just top it, or kill it in the task manager (a reboot might have it open again)


You probably have SMTP installed as a role , so you can just remove it from the Server 2008 Role manager.
 
well it seems the server is sending out mail and it shouldn't be, the guys on that network dont want the
windows firewall turn on as it causes issues with other apps and access etc, also checked and smtp is not
is not installed
 
Deep78 said:
well it seems the server is sending out mail and it shouldn't be, the guys on that network dont want the
windows firewall turn on as it causes issues with other apps and access etc, also checked and smtp is not
is not installed
Click to expand...

I am assuming there is some other firewall on the network, why not just write a rule over there?
 
Its simple run netstat /a -n -b find the process involved with port 25 and delete the related exe, if its some sort of root kit, then you are , well you know the rest.
 
SBSP said:
Its simple run netstat /a -n -b find the process involved with port 25 and delete the related exe, if its some sort of root kit, then you are , well you know the rest.
Click to expand...


def not a root kit, av was run everything else was checked. oh tried the netstat /a -n ( wont do the -b) and i dont
see anything on port 25.

as for doing the rule on the network firewall well that's was doen but they are insisting
it be done on the server as well, hence wanting to know if i can block a port on the local server
without turning on the "local" firewall.
 
Last edited:
To be honest, I dont think you can just disable a port as such its the application that opens it.
But i might be wrong, maybe there is a registry setting that will allow you to disable the use of an individual port number.
 
If the server is sending out mail it will probably not be from port 25 so don't waste to much time with that (unless it has been confirmed it's using port 25 to send the mail. Rather find what is sending the mail from the server and remove that.
 
def confirmed on port 25, and trying the latter as well trying to isolate what account is sending.
 
Deep78 said:
def confirmed on port 25, and trying the latter as well trying to isolate what account is sending.
Click to expand...

Cool, where are they picking up that the server is sending mails? Firewall, mail server or ISP side? What mail server do you guys use?
 
blocking TCP port 25 will prevent incoming mail as SMTP uses TCP port 25, if the server is sending mail in order to stop this you need to use the external firewall to block outgoing TCP 25 from the servers IP.

Then you need to check what is running on the server that is sending the mail out.
 
Your antivirus may have a setting to prevent mails being sent eg in McAfee it is called 'Prevent mass mailing worms from sending mail' in the antivirus standard protection settings.

Is it possible that you have some sort of email notification settings enabled in Windows or any of the applications on the server? If you're malware free, that may be the source of the emails.
 
You can download PortRptr.exe from MS and see if it really is port 25
 
Ok Start from scratch, cus now we are talking about listening and transmitting which is 2 different things.

A random port is used to send traffic or to connect to a destination, UNLESS the application binds to specific port.
When its receiving traffic by opening a Port then its just a specific port.

If someone is sending spam via Port 25 via your network then this means that your server is used as an Open Relay.
Normally this is caused when companies want to make use of POP3 and SMTP from mobile devices without using VPN
Because then you have to allow any IP from the outside onto your SMTP server.

Right So , the Firewall has now been set to NOT allow connections on port 25.
This means that the "Spammer" is not able to relay traffic via your network anymore ? is this correct or does it still happen ?
 
Last edited:
If said server is NOT used for emails, install some arb application (ultravnc/filezilla server etc) and force it to use port 25...

If it starts up before the offending (spam) app, then you should be sorted...

Or use a proper, dedicated firewall, such as Smoothwall... With Full Firewall Control you can block this specific PC's port 25 only.
 
Last edited:
thanx guys ... found the issue!!! IIS was sending out a scheduled task scripted to send out
hundreds of mails with logs etc almost every hour! took us a while to find that!
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X