This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Need to block IP while using SMTP proxy

Hi,

I need to block a whole network due to the fact that this network is sending massive bogous emails.

Here a sample:

2005-11-21 18:06:23  Received from <> H=(smtp.domain.com) [192.168.*.*] P=esmtp S=5353 id=xqS1wicRW1030158f@smtp.domain.com
2005-11-21 18:06:25  mx2.hanmail.net [211.43.197.144]: Connection refused
2005-11-21 18:06:28  SMTP error from remote mailer after RCPT TO:: host mx2.hanmail.net [211.43.197.172]: 550 5.1.1 ... Inactive mbox
2005-11-21 18:06:28  foruk@hanmail.net R=dnslookup T=remote_smtp: SMTP error from remote mailer after RCPT TO:: host mx2.hanmail.net [211.43.197.172]: 550 5.1.1 ... Inactive mbox
*** Frozen (delivery error message)

or

2005-11-21 17:11:19  Received from <> H=(smtp.domain.com) [192.168.*.*] P=esmtp S=5377 id=xW4k7WWWv0200523e@smtp.domain.com
2005-11-21 17:11:22  SMTP error from remote mailer after RCPT TO:: host mx9.hanmail.net [211.43.197.15]: 551 5.7.1 Relaying denied
2005-11-21 17:11:22  flatron2004@hanmail.net R=dnslookup T=remote_smtp: SMTP error from remote mailer after RCPT TO:: host mx9.hanmail.net [211.43.197.15]: 551 5.7.1 Relaying denied
*** Frozen (delivery error message)

and so on

Unfortunately the packet filter is "behind" the smtp proxy - this really makes no sense to me. Even for a novice users, the packet filter should be the first layer the packets have to pass.

I searched for a solution and found a thread where the user DNATed the packets to a 'nowhere host' (non existing IP address). I found out that this does not work either.

Blacklist etc. does not help either.

What is the solution here - I need to block this spammer.

Thanks
Ed

running: V5.206

This thread was automatically locked due to age.

Parents

0 KLambert over 19 years ago

Apologies for the necroposting, but I'm having the same issue (with the same hanmail spammer actually). Though this is an attempt to use our firewall as a relay. The volume is enough to bring our net access to a halt just rejecting the relay attempts.

Is there any way to block packets before they hit the SMTP proxy?

I've defined the offending network and added a rule to drop packets at the top of the packetfilter rules, but it seems like the smtp filter kicks in before the packet filter. (That or I'm not doing the packet filtering correctly.)

2006:02:27-08:53:02 (none) exim[10625]: 2006-02-27 08:53:02 no host name found for IP address 61.83.179.150
2006:02:27-08:53:04 (none) exim[10625]: 2006-02-27 08:53:04 H=(winxp) [61.83.179.150] F= rejected RCPT hotdama@hanmail.net: Relay not permitted
2006:02:27-08:53:04 (none) exim[10625]: 2006-02-27 08:53:04 unexpected disconnection while reading SMTP command from (winxp) [61.83.179.150]
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 KLambert over 19 years ago

Apologies for the necroposting, but I'm having the same issue (with the same hanmail spammer actually). Though this is an attempt to use our firewall as a relay. The volume is enough to bring our net access to a halt just rejecting the relay attempts.

Is there any way to block packets before they hit the SMTP proxy?

I've defined the offending network and added a rule to drop packets at the top of the packetfilter rules, but it seems like the smtp filter kicks in before the packet filter. (That or I'm not doing the packet filtering correctly.)

2006:02:27-08:53:02 (none) exim[10625]: 2006-02-27 08:53:02 no host name found for IP address 61.83.179.150
2006:02:27-08:53:04 (none) exim[10625]: 2006-02-27 08:53:04 H=(winxp) [61.83.179.150] F= rejected RCPT hotdama@hanmail.net: Relay not permitted
2006:02:27-08:53:04 (none) exim[10625]: 2006-02-27 08:53:04 unexpected disconnection while reading SMTP command from (winxp) [61.83.179.150]
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data