It's not enforced. I've had HTTP and SSH available on Comcast and Verizon lines for... decades, I guess. No one cares.

SMTP is more problematic because of spam: outbound traffic on port 25 is blocked, so a true home mail server won't work without a reachable gateway mail server somewhere else. That's basically what the linked product is: they manage the protocol side of the service on your behalf, and forward all the content to your local device which connects to them via some internal protocol.

AT&T in the midwest US just blocked port 25 a few months ago. My nightly e-mails for system updates stopped coming in, and now I either have to shuttle them through an authenticated submission port or pump them over a VPN to my e-mail server. :-/

You can pay $50 and they will open it once again for you. I only know that after much trial and error troubleshooting why my public NTP service doesn’t work (port 123 also blocked).

Can the normal customer service do that? And is it $50 a month or a one time fee? Were you able to unlock outgoing port 25? (Fellow AT&T user here)

It’s a $50 one time fee. You need to call their “premium” service. Not sure if they do it per port or what, but I asked them to open all my ports and verified 25 is accessible (123 udp inbound still blocked for unexplained reasons).

They’re still clueless. I tried to explain that it’s being blocked by AT&T and not my router but eventually I just gave up. Their process involves a logmein session where they take control and mess with your router. Gahd it’s awful.

They also randomly added my “device” (home server) to the DMZ so all of its ports were exposed. Be very careful.

>123 udp inbound still blocked for unexplained reasons

NTP was part of a massive DRDoS not too long ago. It's possible they pruned it somewhere much further up the network under the (not insane) assumption that most customers don't need to run their own time servers that answer public queries.

An ISP I worked for blocked port 25 in 2009, but it was easily reenabled by the customer checking a box in their online portal.

Considering how easily it is to setup authenticated SMTP and how effective it is at reducng spam for the ISP, I'm Surprised it took AT&T this long.

Assuming you control both sides, which sounds like you do, just run it on a different port in addition to 25.

Ironically it doesn’t look like they restrict sending mail in the above quote, only serving it. If that’s a violation, so would be using your browser.

In the US it's standard that residential accounts don't get to do that, but business accounts (which are usually double the price for the same speed but come with better/quicker support, particularly when physical lines are down, and an open connection) are allowed to run on-prem. And usually with a residential account you don't get a static IP as an option, but if you're lucky you can pay extra for one.

> And usually with a residential account you don't get a static IP as an option, but if you're lucky you can pay extra for one.

I use a VPS as a proxy. SSH with AutoSSH. I use a VPS ($15/yr), map the ports from the VPS to the server at home.

For example, when you hit 80/443 on the VPS, it's routed to a reverse proxy in the apartment, then to the correct service.

Not a bad setup.

I tried to get a business account once at Comcast, and they wouldn't give me one that terminated at an apartment. : /

That's weird, I honestly wouldn't have expected that. They gave me a little resistance with one terminating at a home but ultimately they did it. They probably start to weigh the pros/cons (ie the money) of business level service to large residential buildings and decide it isn't worth it. Maybe too many variables once the line enters the building?

Maybe the building part. But I've never had any issue - at three homes - with Comcast Business being run into my home garage.

Read your terms of service. The same section is definitely present for all Canadian ISPs as well.

"The residential Shaw Services are designed for personal Internet use. You may not use the residential Shaw Services for commercial purposes. You may not run a server in connection with the Shaw Services nor may you provide network services to others via the Shaw Services. Examples of prohibited servers and services include but are not limited to mail, http, ftp, irc, dhcp servers, and multi-user interactive forums. Some business services may be exempt from these limitations."

https://www.shaw.ca/uploadedFiles/Terms_of_Use/Acceptable_Us...

In Ontario, Canada I know that Bell, Rogers, and Teksavvy all block outbound TCP 25 for their residential service. I can't comment on inbound TCP port 25 though.