Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 2082 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

#1 blocked traffic is Commtouch IP Addr - the vendor used by Astaro for anti-spam

SalishSwede
So I noticed that the number one source of blocked traffic is 216.163.188.34 which is a Commtouch address.  

Is this a bug in the config?  
Does this break the anti-spam engine?
Should we create a rule to allow this traffic?

Thanks


This thread was automatically locked due to age.
  • 0
    I'm not seeing this.  Doug, what shows blocked in the Firewall log file?  How about a line from there?

    Correction!  I see what you mean, now.  I also have blocks from 216.163.188.45.  It looks like almost all are RSTs for HTTP requests.  I don't think that affects the functionality, but this is either a minor bug in Astaro or in the configuration of the servers at those IPs.  If you're working the V9 beta, you likely could get credit for a bug find there.  Here's a line from my log: 
    2012:03:13-02:44:09 astaro ulogd[4942]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth1" srcmac="0:1f:ca:20:5f[:D]a" dstmac="0:xx:xx:xx:xx:5f" srcip="216.163.188.34" dstip="70.x.y.145" proto="6" length="40" tos="0x00" prec="0x00" ttl="57" srcport="80" dstport="56595" tcpflags="RST"


    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    Oops!  Corrected my post above!  Doug found a bug!

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Indeed, I've been seeing Commtouch IPs listed as blocked for quite a while... in my case, it's IP 64.191.223.36 (I'm sure this varies depending on what geographical location you are in).  Doesn't seem to affect mail flow, I'm guessing the lost packets are being re-sent.  It's been doing it for a while, at least as far back as 8.103 (production system is on 8.301 currently).

    Doug, I'd start a case with Astaro Support so they can take a look at this.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0 in reply to BrucekConvergent
    Looks like this is a bug.
    I'm on 8.301 as well.
Cookie Information Banner