Dear reader,

I'm using a third party external spam filter (GFI). I also have an exchange edge with Forefront TMG and forefront for exchange in my perimeter. Ths machine will we replaced by some fortinets soon, but for now i have to find a way to only allow the ip address ranges to communicate with our exchange system.

I tried to simply allow ip addresses from GFI to communicate with port 25, but this rules seems to be a system default rule in TMG that cannot be altered.

So I have set all ip addresses from GFI in my IP allow list, to make sure the messages that are checked by GFI, are not checked again by Forefront.

All mx records point to the GFI mailservers. But I noticed backscatter on my system. I think a spammer still delivers spam on my external  ipaddress on port 25. Since it seems not to be possibel to block port 25 for all ip addresses except the GFI addressen, I thought I could enable and use the ip block list.

Now my question is:

Will the ip block list take precedence over the ip allow list or vica versa? This is what I want:

ip allow list: ip adresses GFI

ip block list: 0.0.0.0 255.255.255.255

Will everything be blocked now, or will the ip addresses from GFI be allowed?

Thanks in advance

Best regards,

Ruud Boersma