Restricting SMTP Access with ACLs on Citrix NetScaler

I had to configure a Citrix NetScaler (version 10.5) to load balance SMTP for an organisation that relayed mail through Microsoft’s smart host. Only specific source IP addresses should be able to reach port 25.

This is all done from the CLI. In the GUI, the same settings are under Configuration → System → Network → ACLs.

In this example, the permitted senders are 1.1.1.1 and 2.2.2.2.

Create the ACLs #

> add ns acl ALLOW-SMTP-1.1.1.1 ALLOW -srcIP = 1.1.1.1 -destPort = 25 -protocol TCP -priority 10
 Done
> add ns acl ALLOW-SMTP-2.2.2.2 ALLOW -srcIP = 2.2.2.2 -destPort = 25 -protocol TCP -priority 20
 Done
> add ns acl RESTRICT-SMTP-ALL DENY -srcIP = 0.0.0.0-* -destPort = 25 -protocol TCP -priority 50
 Done

There’s no implicit deny or permit at the end of a NetScaler ACL list, so you need the explicit DENY rule to block everyone else. Lower priority numbers are evaluated first.

Apply them #

ACLs don’t take effect until you apply them:

> apply ns acls
 Done

Remove them #

Remove a single ACL:

rm ns acl ALLOW-SMTP-1.1.1.1

Or remove them all at once:

clear ns acls