Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 19500 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SMTP Attacks - Block/Blacklist IP

GZgidnick
Hi guys,

I am failing to find an effective way to blacklist of IP addresses that are generating reoccurring SMTP attacks (Brute force password guessing).

Sophos is used as a Relay host for Exchange.

Please note that I do not want to create deny rules in the firewall and make a complete mess.

I have blacklisted the IP address into:
Email Protection > SMTP > Relaying Tab >  Host/Network Blacklist
however though this seems to not be having any effect as the same IP address are generating more attacks.
Sophos blocks them for 600 sec after to many passwords guessing but that is just not enough.

Is there any way I can maintain IP blacklist on the WAN interface without messing up with IP Tables?


This thread was automatically locked due to age.
Parents
  • 0
    GZ, I sent you there for an overall evaluation. In fact, there's no reason that folks should have an opportunity to login to your SMTP relay.  The only thing that should be allowed to relay off the SMTP Proxy is your Exchange server.  Transparent mode should NOT be enabled.

    Cheers - Bob
    PS This appears to be the answer to your other question  or ???
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    GZ, I sent you there for an overall evaluation. In fact, there's no reason that folks should have an opportunity to login to your SMTP relay.  The only thing that should be allowed to relay off the SMTP Proxy is your Exchange server.  Transparent mode should NOT be enabled.

    Cheers - Bob
    PS This appears to be the answer to your other question  or ???
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML