---
title: 'firewall:smtp'
url: 'https://docs.danami.com/juggernaut/command-line-interface/firewall/firewall-smtp'
markdown: 'https://docs.danami.com/juggernaut/command-line-interface/firewall/firewall-smtp.md'
date: '2026-10-07'
description: 'Block outgoing SMTP except for root, qmail/postfix and mailman. juggernaut --task=firewall:smtp Option Value Default Description --SMTP_BLOCK <1|0> 0 Block outgoing SMTP except for root, qmail/postfix and mailman. This forces scripts/users to use the qmail/postfix binary instead o…'
taxonomy:
  category:
    - docs
  tag:
    - smtp
---

[](#)  [ Basics ](https://docs.danami.com/juggernaut/)     [ Command Line Interface ](https://docs.danami.com/juggernaut/command-line-interface)      Firewall       firewall:smtp    

# firewall:smtp

Block outgoing SMTP except for root, qmail/postfix and mailman.

```
juggernaut --task=firewall:smtp
```

| Option | Value | Default | Description |
|---|---|---|---|
| `--SMTP_BLOCK` | <1\|0> | 0 | Block outgoing SMTP except for root, qmail/postfix and mailman. This forces scripts/users to use the qmail/postfix binary instead of sockets access. This option requires the iptables ipt\_owner/xt\_owner module to be loaded. |
| `--SMTP_ALLOWLOCAL` | <1\|0> | 1 | Allow outgoing SMTP connections to the loopback device on port 25 (If SMTP\_BLOCK is enabled). |
| `--SMTP_REDIRECT` | <1\|0> | 0 | Redirect outgoing SMTP connections destined for remote servers for non-bypass users to the local SMTP server to force local relaying of email. Such email may require authentication (SMTP AUTH). |
| `--SMTP_PORTS` | <string1,string2> | 25,465,587 | SMTP ports to block. You should list all ports that qmail/postfix is configured to listen on. |
| `--SMTP_PORTS_add` | <string> |  | Add a single entry to SMTP\_PORTS. |
| `--SMTP_PORTS_del` | <string> |  | Remove a single entry from SMTP\_PORTS. |
| `--SMTP_ALLOWUSER` | <string1,string2> | postfix,qmaild,qmaill,qmailp,qmailq,qmailr,qmails | Allow the following comma separated users to bypass SMTP\_BLOCK. Note: root user is always allowed. |
| `--SMTP_ALLOWUSER_add` | <string> |  | Add a single entry to SMTP\_ALLOWUSER. |
| `--SMTP_ALLOWUSER_del` | <string> |  | Remove a single entry from SMTP\_ALLOWUSER. |
| `--SMTP_ALLOWGROUP` | <string1,string2> | mail,mailman,nofiles,postdrop,postfix,qmail | Allow the following comma separated groups to bypass SMTP\_BLOCK. Note: root group is always allowed. |
| `--SMTP_ALLOWGROUP_add` | <string> |  | Add a single entry to SMTP\_ALLOWGROUP. |
| `--SMTP_ALLOWGROUP_del` | <string> |  | Remove a single entry from SMTP\_ALLOWGROUP. |
| `--default` | <yes> |  | Reset all settings to their default values. |
| `--default_option` | <option> |  | Reset a specific setting to its default value. |
| `--restart` | <yes> |  | Restart the service after saving settings. |

## Examples

```
// enable SMTP_BLOCK
juggernaut --task=firewall:smtp --SMTP_BLOCK=1 --restart=yes

// reset SMTP_BLOCK back to default
juggernaut --task=firewall:smtp --default_option=SMTP_BLOCK --restart=yes

// reset all settings back to default
juggernaut --task=firewall:smtp --default=yes --restart=yes

// block user level outgoing SMTP and force non mail users to relay through the local MTA
juggernaut --task=firewall:smtp --SMTP_BLOCK=1 --SMTP_REDIRECT=1 --restart=yes

// also block the alternate SMTP port 1025
juggernaut --task=firewall:smtp --SMTP_PORTS_add=1025 --restart=yes
```

## Related Pages

- [SMTP Settings](https://docs.danami.com/juggernaut/settings/firewall/smtp-settings "SMTP Settings")

 [](https://docs.danami.com/juggernaut/settings/firewall/smtp-settings)

---

## Navigation

- Previous: [firewall:portknocking](https://docs.danami.com/juggernaut/command-line-interface/firewall/firewall-portknocking.md)