I supply email accounts to customers. Occasionally some customers are blocked by our firewall (CSF) if they get the usernames or password wrong. But sometimes they get blocked because their IP address was determines to be port scanning the mail server. The log message would be:
Temporary Blocks: IP:220.127.116.11 Port: Dir:in TTL:3600 (lfd - *Port Scan* detected from 18.104.22.168 (GB/United Kingdom/-). 21 hits in the last 261 seconds)
Because they are not hackers, just a normal business office, one possibility is a computer has a virus and is trying to connect to the mail server, perhaps it obtained the mail server settings from Apple Mail. But I doubt this to be the case.
So does anyone know what other software could be performing port scans on the Apple Mail mail server? Apple Mail itself? We would need to stop these "scans".
Edit: Just found out its all Macs and Apple Mail in the office, not Outlook. And they have a temporary EE (mobile provider) box to connect to the internet because BT are taking ages to sort their internet out. Have updated question above.
Edit: The customer was connecting to port 585 very often and were being blocked. This port is not open in our firewall. But it seems port 585 is indeed an IMAP port, and various websites state Apple Mail uses it. So I have had to open this port due to Apple Mail using it.
Edit: See accepted answer, but instead of opening the port, I added it to DROP_NOLOG in the CSF settings. Accepted answer shows how to do that using iptables command if not using CSF.