Depending on your set up, you may also want to consider the following ports:

995 POP3S
143 IMAP
993 IMAPS
465 SMTPS
587 STARTTLS

thank you very much.

LAN users using mail app via smtp and pop3 not via browser.

i will try your code and i think the rule will work fine.

thank you very much.

My Friend Nick;

thanks for your help share info.

my Egress firewall block all and i opened the smtp and pop only to make my users in lan network using mail service.

but i need to make my user using smtp and pop3 for the company domain only because i found many users using gmail and hotmail and others
so i need to make control and block all that by make the smtp and pop3 for just my company domain.

so can you tell me what is the rule make smtp and pop3 for only my domain ?
reminder my Egress firewall block all and i have opened the smtp and pop3 so i need from custom firewall to add rule to make the smtp and pop3 for specific domain.

also i need to know how to test the rule via command before added it in custom rule.

thank you very much

By default the Egress firewall is open. Have you changed the default operation?

If you use an external provider for your smtp and pop and you want to block access to anywhere else you can probably do it with a single complex rule for anyone on your LAN:

iptables -I FORWARD -p tcp -m multiport --dports 25,110 ! -d your_permitted_ip -j DROP

but test it first. It might be ambitious doing it in a single rule. It won't work with multiple IP's. If you have multiple IP's you'll need a general block rule followed by specific allow rules.

Iptables by domain are a bad idea if the domain resolves to more than one IP address and name resolution only happens when the firewall is loaded and never again. If the name resolves to a different IP when the user comes to access the domain, the firewall will not see the rule.

thank you eng. Nick for reply.

can you tell me how to test it via command ?

because i need to make allow for pop3 & smtp for specific domain and the Egress Firewall allow outgoing for all domains.

so can you help me for that ?

The best place to try any rules out is at the command line. Any rules added there automatically get wiped if the firewall is restarted. You will also be able to see if there are any error messages.