Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 2 subscribers
  • Views 6114 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP Proxy DoS'd?

garpace

I noticed my SMTP logs explode in size two days ago and investigated to find that an IP address keeps trying to connect.  I don't know why, but I run a very small email server for home use, so I'm thinking botnet or something.  I did a bit a research on the forums on ways to deal with this, including a DNAT blackhole and listing the IP as a blacklisted SMTP relay, but my SMTP logs continue to show the UTM starting the connection process.  Can someone tell me the right way to basically blacklist this IP?

 

Here's a sample of my SMTP logs:

2018:05:31-00:00:03 utm exim-in[30095]: 2018-05-31 00:00:03 SMTP connection from (ylmf-pc) [54.36.39.55]:50654 lost
2018:05:31-00:00:03 utm exim-in[25177]: 2018-05-31 00:00:03 SMTP connection from [54.36.39.55]:61031 (TCP/IP connection count = 1)
2018:05:31-00:00:04 utm exim-in[30098]: 2018-05-31 00:00:04 SMTP connection from (ylmf-pc) [54.36.39.55]:61031 lost
2018:05:31-00:00:04 utm exim-in[25177]: 2018-05-31 00:00:04 SMTP connection from [54.36.39.55]:56425 (TCP/IP connection count = 1)
2018:05:31-00:00:04 utm exim-in[30105]: 2018-05-31 00:00:04 SMTP connection from (ylmf-pc) [54.36.39.55]:56425 lost
2018:05:31-00:00:04 utm exim-in[25177]: 2018-05-31 00:00:04 SMTP connection from [54.36.39.55]:50948 (TCP/IP connection count = 1)
2018:05:31-00:00:04 utm exim-in[30106]: 2018-05-31 00:00:04 SMTP connection from (ylmf-pc) [54.36.39.55]:50948 lost
2018:05:31-00:00:04 utm exim-in[25177]: 2018-05-31 00:00:04 SMTP connection from [54.36.39.55]:61221 (TCP/IP connection count = 1)

 

That's just a few seconds... my logs went from under 100k a day to a few MBs!  Please help!



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to garpace

    You might want to consult Basic Exchange setup with SMTP Proxy.

    I'm surprised that the Proxy saw the packet before the blackhole DNAT.  Did you not select an automatic firewall rule in the DNAT?  See #2 in Rulz.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Bob,

      Thanks as always for your help.

     

      I did have automatic firewall rule turned on for the DNAT.  I had transparent mode on, which is what I think was causing the proxy to accept the packet before DNAT - I confirmed from logs as soon as I added the IP to be excepted from transparent interception of SMTP traffic, the blackhole started working.  I hate to go against the Rulz, but are you sure DNAT is before the SMTP proxy?

     

      Thanks for the pointer to the basic exchange setup - trying now to turn off transparent mode altogether and follow that setup.

  • 0 in reply to garpace

    If you look at the two charts attached to the bottom of that post, you see that DNATs come before the EXIM local process.  Those packets never should have made it into the INPUT chain.

    I would consider that a bug, depending on your DNAT - how about a picture of the Edit of your DNAT?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML