This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Need to block IP while using SMTP proxy

Hi,

I need to block a whole network due to the fact that this network is sending massive bogous emails.

Here a sample:

2005-11-21 18:06:23  Received from <> H=(smtp.domain.com) [192.168.*.*] P=esmtp S=5353 id=xqS1wicRW1030158f@smtp.domain.com
2005-11-21 18:06:25  mx2.hanmail.net [211.43.197.144]: Connection refused
2005-11-21 18:06:28  SMTP error from remote mailer after RCPT TO:: host mx2.hanmail.net [211.43.197.172]: 550 5.1.1 ... Inactive mbox
2005-11-21 18:06:28  foruk@hanmail.net R=dnslookup T=remote_smtp: SMTP error from remote mailer after RCPT TO:: host mx2.hanmail.net [211.43.197.172]: 550 5.1.1 ... Inactive mbox
*** Frozen (delivery error message)

or

2005-11-21 17:11:19  Received from <> H=(smtp.domain.com) [192.168.*.*] P=esmtp S=5377 id=xW4k7WWWv0200523e@smtp.domain.com
2005-11-21 17:11:22  SMTP error from remote mailer after RCPT TO:: host mx9.hanmail.net [211.43.197.15]: 551 5.7.1 Relaying denied
2005-11-21 17:11:22  flatron2004@hanmail.net R=dnslookup T=remote_smtp: SMTP error from remote mailer after RCPT TO:: host mx9.hanmail.net [211.43.197.15]: 551 5.7.1 Relaying denied
*** Frozen (delivery error message)

and so on

Unfortunately the packet filter is "behind" the smtp proxy - this really makes no sense to me. Even for a novice users, the packet filter should be the first layer the packets have to pass.

I searched for a solution and found a thread where the user DNATed the packets to a 'nowhere host' (non existing IP address). I found out that this does not work either.

Blacklist etc. does not help either.

What is the solution here - I need to block this spammer.

Thanks
Ed

running: V5.206

This thread was automatically locked due to age.

Parents

0 RFCat_vk_01 over 19 years ago

Why not report it to your ISP and get them to block it on their border. If it is one of their customers they can deal with it.

Ian M [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 eager over 19 years ago in reply to RFCat_vk_01

This will be my last option I guess.

I have also reported to the responsible persons of the network in Korea - but seems that they do not care.

Still the packet filter should be the first layer the packets need to pass through before reaching the Proxy. Nice feature request BTW.

Any technical solution on how to pimp the gateway so the PROXY is behind the packet filter?
Cancel
Vote Up 0 Vote Down

Cancel
0 RFCat_vk_01 over 19 years ago in reply to eager

There is another mob that run lists of bad sites, one of them provides info to Astaro as part of the extras licence package.

Ian M [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 doug_p over 19 years ago in reply to eager

If you have a router between you and your ISP, you could block the IP there (rather than ask your ISP to block it at their router), before it gets to ASL.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 doug_p over 19 years ago in reply to eager

If you have a router between you and your ISP, you could block the IP there (rather than ask your ISP to block it at their router), before it gets to ASL.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data