I've got Authenticated relaying enabled. Any IP I put in Block hosts still gets through and I get warning mails about failed authentication. What to do?
it looks like that Email Protection now has higher priority than SMTP DNAT
You may want to take that to support, if paid license. They will not be able to fix it, but can get it up the chain to dev. Proxy having higher precedence than NAT has some severe connotations that'll break a lot of configurations.
__________________ ACE v8/SCA v9.3
...still have a v5 install disk in a box somewhere.
I'm having the same exact issue. Tech support has been less than helpful. I'm chasing my own tail here to block an SMTP AUTH botnet. Once I realized that firewall rules take lower precedence than Proxy, I tried using DNAT to route the bad logins to a bogus (blackhole) address.
1.) It is crazy that I can't easily import and block a list of IP addresses (or better yet, use a service like dshield or blocklist.de)
2.) It is crazy that Sophos changed the precedence in 9.3x! The spambots can still attempt a log in even though I have DNAT pointing ANY traffic FROM a group of spambot host entries TO an unused internal IP address.
The failed login attempts are authenticating against backend AD servers. And then too many bad login attempts locks out my users!
At least a DNAT blackhole sounds like it used to be somewhat helpful... I regret upgrading to 9.3! [:@] So what is the new order of precedence?
What is the simplest way to let my home office/mobile/smart phone users send email? Should I stop using relay for authenticated users on the UTM and instead port-forward directly to my Exchange box and let it handle authentication and relay?
I'm having the same exact issue. Tech support has been less than helpful. I'm chasing my own tail here to block an SMTP AUTH botnet. Once I realized that firewall rules take lower precedence than Proxy, I tried using DNAT to route the bad logins to a bogus (blackhole) address.
1.) It is crazy that I can't easily import and block a list of IP addresses (or better yet, use a service like dshield or blocklist.de)
2.) It is crazy that Sophos changed the precedence in 9.3x! The spambots can still attempt a log in even though I have DNAT pointing ANY traffic FROM a group of spambot host entries TO an unused internal IP address.
The failed login attempts are authenticating against backend AD servers. And then too many bad login attempts locks out my users!
At least a DNAT blackhole sounds like it used to be somewhat helpful... I regret upgrading to 9.3! [:@] So what is the new order of precedence?
What is the simplest way to let my home office/mobile/smart phone users send email? Should I stop using relay for authenticated users on the UTM and instead port-forward directly to my Exchange box and let it handle authentication and relay?
