I'm not sure when, but a couple-ish weeks ago I noticed a lot of spam e-mails coming in. I checked the SMTP logs and I don't see any incoming e-mails being logged even though the UTM seems to be relaying them to the internal e-mail server. I see random connections from addresses such as:
019:06:14-09:50:56 utm exim-in[5528]: 2019-06-14 09:50:56 SMTP connection from [107.170.202.224]:34776 (TCP/IP connection count = 1) 2019:06:14-09:51:00 utm exim-out[25083]: 2019-06-14 09:51:00 Start queue run: pid=25083 2019:06:14-09:51:00 utm exim-out[25083]: 2019-06-14 09:51:00 End queue run: pid=25083 2019:06:14-09:51:06 utm exim-in[25079]: 2019-06-14 09:51:06 TLS error on connection from [107.170.202.224]:34776 (SSL_accept): error:00000000:lib(0):func(0):reason(0) 2019:06:14-09:51:06 utm exim-in[25079]: 2019-06-14 09:51:06 TLS client disconnected cleanly (rejected our certificate?)
And I see outgoing e-mails being relayed but incoming e-mails aren't showing up in the log. Any ideas why this would be?
This thread was automatically locked due to age.