Mail Server behind FW - advice needed

[liq]

Firstly, apologies, I am a newbie.
I would be most appreciated if anyone can help me with the following setup:

I am trying to get my MS Exchange server 5.0 to route through our Checkpoint firewall to our ISP to send and recieve mails. We are using Checkpoint Firewall-1 v4.0 on a dual homed NT system. I can send mails out, but not recieve them. The sender recieves an "unroutable mail domain" error message. I have asked our ISP to foreward any mail with "@ourdomain.co.uk" onto the ipaddress of our firewall but I'm not sure what do from that point on or what needs to be configured within the firewall to allow the incoming mails to see the mailserver. I have allowed SMTP but do I need to tell my ISP to foreward mail onto another free external IP-address rather than the FW and use static NAT to translate this to the internal address of the mailserver?

Also, am I right in thinking that this seems to pose an obvious security risk, would it be better to put another network card into the firewall and setup a DMZ with some sort of SMTP gateway/proxy as a go-between. In this instance, would I tell my ISP to foreward mails onto the firewall IP-address or onto the IP-address of the SMTP Proxy server? Do you know of any software that can be used as the SMTP relay/gateway (I have a copy of MS Proxy server v2.0 but I'm not sure if it can do the job)?

Also, we don't host our own DNS server, so would this cause a problem or can we just foreward DNS queries onto our ISP's?

Any help would be *much* appreciated and sorry if I've asked stupid questions I'm still learning.

 

[niles]

I need to know how you set up your policies. From there I can maybe help you.

 

[liq]

Ok, firstly thanks for the response.

We are now running Checkpoint 2000 with the following policys:

Rule 1 = My PC in the localnet to talk to the firewall using the FW1 service to be accepted (for remote admin)
Rule 2 = Local network to talk to the firewall using the domain-udp service to be accepted (for DNS - DNS cache server installed on the FW)
Rule 3 = Any source talking to the fw using any service to be dropped (drops any account that is not a member of the FW1 admin)
Rule 4 = source Localnet destination localnet (negated)using the smtp, dns, http, https, Echo request, ftp, nntp, ssh, telnet, traceroute, pop3 services to be accepted (the chosen allowed internet services)
Rule 5 = Localnet source localnet (negated) destination using Winframe, http, https services to be accepted (for citrix access to our HQ server)
Rule 6 = Localnet (negated) to localnet using the echo-reply service to be accepted (to allow replies from the internet).
Rule 7 = localnet to localnet to be accepted using any service.
Rule 8 = any source, any destination using the nbt service to be dropped. (silent drop 4 netbios)
Rule 9 = localnet to any destination using any service to be rejected (to reject all other non-specified services)
Rule 10 = any source, any destination any service to be dropped (to hide the fw from the internet)

The localnet is set for hidden address translation.

Do you need anything else?

 

[mottster]

Do you have the Exchange server defined in the firewall with a static (real) IP natted to it?

 

[liq]

I have the exchange server defined as a host with a static NAT and I have tried different rules allowing SMTP to the server but still no joy. I am in the process of building an SMTP server to go in the DMZ so this may help solve the mystery.