Unable to block IP address.

Isn't having the MTA advertised on the WAN port an open invitation for the internet to use it?

MTA should be between the internal exchange server and the internet.

Ian

I followed this guide to enable SMTP scanning  -- https://community.sophos.com/kb/en-us/125596

You are instructed to enable SMTP Relay on WAN zones in the guide.

I do not allow relay, they are all getting rejected. Its just a little annoying seeing the attempts trying to be made. 

This is "normal".

Can you post your General Settings? Do you have all advanced SMTP Settings features enabled? 

But to be honest, XG only logs them because the SMTP Transmission is open for everybody. 

https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_transport_example

XG drops them after "RCPT TO".

Here are the settings from the general tab.

Thanks

Just wanted to post an update as I believed I fixed this issue.

I found and followed this guide https://community.sophos.com/kb/en-us/123663  Which uses the Email Scanning Business application template rule.

I set the rule up like this, and kept SMTP relay enabled on WAN zone. As well as keeping original LAN SMTP scanning rule.

Now the only thing appearing in my mail logs is the actual email to and from my exchange server.

Thanks for all of the help everyone!

Just wanted to post an update as I believed I fixed this issue.

I found and followed this guide https://community.sophos.com/kb/en-us/123663  Which uses the Email Scanning Business application template rule.

I set the rule up like this, and kept SMTP relay enabled on WAN zone. As well as keeping original LAN SMTP scanning rule.

Now the only thing appearing in my mail logs is the actual email to and from my exchange server.

Thanks for all of the help everyone!

You should check, whether you can relay now or not. 

SMTP is kinda dangerous to configure, so be sure, everything works properly.

https://www.port25.com/how-to-check-an-smtp-connection-with-a-manual-telnet-session-2/

A word of warning, not all .ru sites are sourced from Russia, I found that some are sourced using US data centres.

Ian

LuCar Toni said:

You should check, whether you can relay now or not. 

SMTP is kinda dangerous to configure, so be sure, everything works properly.

Thanks I will double check and make sure I am not an open relay.

rfcat_vk said:

A word of warning, not all .ru sites are sourced from Russia, I found that some are sourced using US data centres.

Ian

Yes this is very true, there are several Russian customers in the data center I work in. I am also doing IP blocking not just country blocking, these relay attempts were coming from within the US, and I had explicitly blocked with a firewall rules, however the attempts kept coming through but getting denied.

After making these changes the email logs no longer show any relay attempts, there is only the incoming and outgoing mail for the exchange server.

Thanks again everyone