Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 6 subscribers
  • Views 1959 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP Attacks - RBL/DNAT Blackhole

superbits

We are getting a huge SMTP attack from a number of IPs. I've gone ahead and created a DNAT rule that sends them to a blackhole address, but I'm not understanding why exim is still receiving the TCP connection, if I have everything set correctly. Shouldn't the NAT rule precede the proxy connection, according to the Rulz?



This thread was automatically locked due to age.
Parents
  • +1

    The solution proposed here worked. The suggestion to break out all of the external interfaces individually into a network group and enter that into "Going to" proved to be the solution. Before I was using the subnet of the internet provider, and that did not catch all; although I not sure why that didn't work. Anyways, problem solved. Thanks!

Reply
  • +1

    The solution proposed here worked. The suggestion to break out all of the external interfaces individually into a network group and enter that into "Going to" proved to be the solution. Before I was using the subnet of the internet provider, and that did not catch all; although I not sure why that didn't work. Anyways, problem solved. Thanks!

Children
Unfiltered HTML