DROP Rule Doesn't Work - Trying Block IP Proxy SPAM

Hello there, 

Thank you for contacting the Sophos Community!

Could you please confirm your settings for Scan Outbound and Relay settings?

Make sure you have Scan Oubound enabled and for Relay Settings only your Email server is allowed to send email.

Regards,

Hi Emmanuel, thanks for the reply

Yes i have Scan Outbound checked and the relay settings, only allow our inside email server and email from our web store.

Best regards

And the main thing is, why doesn't the firewall drop any attempts from the IP i configured?
Keeps getting in and rejected.

Hi,

is your drop rule at the very top of your rue list?

What IP address are your trying to block, 188.93.220.49?

Also you are allowing relay from upstream hosts, you try specifying your ISP/mail provider service iP in that field?

Ian

Hi,

Yes ate the very top (BlackList IN). The IP i'm trying to block are:

198.46.189.171, 104.168.211.173, 104.47.0.36, 104.47.1.36, 104.47.2.36

Why do you ask that IP in particular?
Thanks

Bruno

If i put my ISP/mail the emails from the IP 198.46.189.171 keeps getting in although rejected.

The main problem i'm having it's that they that they shouldn't even enter to be rejected. They should been Droped, no?

There are certain modules, which are actually picking up the traffic before the firewall. WAF and Email are one of those.

If you want to avoid this on a IP basis, simply create a blackhole NAT. DNAT the traffic of those IPs port 25 to a non existing IP. It will pickup the traffic before the Email module gets it. 

It worked :) now it's all green , Thanks

NAT Rule .. Now i created a SPAMMER blacklist and added on Original Source. So i could add IP as i need.

Email Logs .. all Green

I asked about that IP address because that is what that url resolves to.

Ian