Customer-facing ACLs

Fri Mar 7 20:43:46 UTC 2008

Justin M. Streiner wrote:
> I do recall weighing the merits of extending that to drop outbound SMTP 
> to exerything except our mail farm, but it wasn't deployed because there 
> was a geat deal a fear of customer backlash and that it would drive more 
> calls into the call center.

This seems to be very common practice these days for larger ISPs/dialup 
aggregators using the appropriate RADIUS attributes on supported access 
servers.

We generally restrict outbound SMTP on our dial-up users so they may 
only reach our hosts (or the mail hosts of our wholesale customers). 
Our DSL subscribers, both dynamic and static, are currently unfiltered 
-- but we're very quick to react to abuse incidents and apply filters 
when necessary until the user cleans up their network.

I'm currently on the fence with regards to filtering SMTP for all of our 
dynamic DSL folks.  It'd be nice to prevent abuse before it happens, but 
it's a matter of finding the time to integrate the filtering into our 
wholesale backend and making sure there aren't any unforeseen issues.

-- Kameron