Using the rule below i see unexpected behavior in the logs. The log excerpt shows three connections. Each of these connections is from a country that is blocked. The rule seems to block all other protocols from blocked countries except SMTP. It allows a lot of SMTP traffic that it should not. The three entries are from Argentina, Japan, and China. The mouse over is from the email that originated in China.
This thread was automatically locked due to age.