Black Hole NAT not working

Exclude the spamers group from Transparent, in Email Protection.

This can happen only when transparent mode is active. This means that email protection owns port 25. Firewall and DNAT rules are useless for port 25 at this point

Thank you for the reply. Sadly our license doesn't cover the "email protection" tab. Is there another way?

I have 'DNAT : Hackers -> Any -> External Address group : to Null Route' and that works for me.  I created it years ago and haven't touched it in forever, so that's why I was curious to learn that it no longer could be created.

Cheers - Bob

Yes works again. But group of uplinks

My Network Group is made up of all the "External [Additional] (Address)" objects.  I've also used "External (Network)" successfully at a client site.

Cheers - Bob

Yes Bob but in the post are included the internal adresses too ☺

Ahhhh - I read right past that!

Cheers - Bob

sadly this did not work. i blocked an IP on the firewall that was trying to authenticate to our email's firewall and i keep seeing the authentication failure attempts even after supposedly blocking the IP. Besides a DNAT, is there anything else I need to set up?

The DNAT rule must be in the top of the rules. And try to put SMTP service, not any!

Disable for the moment any firewall rule for the offender IP.

If the destination DNAT ip is not in your internal network range, masquerade the offender IP with WAN interface

Show us a picture of the Edit of your NAT rule, Chad.

Cheers - Bob

"Spam/Hackers" is a grouping of IPs i have added

"External (Internet)" is the WAN IP of the firewall including CIDR notation

"Null Route" is an IP in a different class/subnet entirely

thanks

Chad put smtp in any service

Chad put smtp in any service

SMTP should be included in the "Any" service, Olsi, so I wonder what we're not seeing...

Chad, are you saying that the hacker's IP doesn't show up in the firewall log - that his packets don't qualify?  Show us the Edit of the Hackers group showing the Host definition for this IP.  Also, show us the Edit of that Host.

Confirm that the 'Going to:' is "External (Internet) (Address)" or "External (Internet) (Network)."

Cheers - Bob

I think DNAT works better with service defined Bob. If not, than should be replaced with SNAT rule. I liker to test by myself, but is not possible today

something is missing from host configuration. 

I've had this for a long time:

Cheers - Bob