When MTA is enabled, it creates an Implied Rule which opens port 25 on all gateway interfaces for connections destined to the gateway by default.