How do I enable tarpit on incoming spammers?

I'm pretty sure that that's not possible, even from the command line.  Next best would be Greylisting.  I don't use it with any of my clients, but some folks like it.  Personally, I think it just slows valid mail without reducing the load on the UTM.

Cheers - Bob

I have now built my own tarpit server.  UTM redirects the subnets of the spammer to my tarpit, where he spends 3 - 10 minutes for each email plodding along talking with my fake smtp server, wasting his resources.  When it gets to the DATA command, it returns and error and drops the connection.

But this guy is so braindead he still sends 2 or 3 a second.  Even though they are 100% rejected, and have been since this campaign started.

Isn't one of the definitions of insanity is doing the same thing over and over, and expecting a different result?

Well, keep them coming spammer.  My tarpit is enjoying the conversation.

OK, I now have Fail2ban installed and running in UTM.

I can't believe I didn't do this sooner.  This is the greatest thing since sliced spam.

Sophos you definitely need to build this into UTM.

Fail2ban is monitoring the smtp log.  When the spammer attacks, it instantly adds the entire /24 subnet to a black-hole route.  And by instantly, I mean in 600 ms.

So, as soon as a spam comes in, I block the entire subnet in less than a second.  Our spammer then tries to send spams over the whole subnet - they are already blocked.  You can't even connect.  I have the ban-time set to 1 year.  I may increase that to 5 years.

Your move spammer.

OK, I now have Fail2ban installed and running in UTM.

I can't believe I didn't do this sooner.  This is the greatest thing since sliced spam.

Sophos you definitely need to build this into UTM.

Fail2ban is monitoring the smtp log.  When the spammer attacks, it instantly adds the entire /24 subnet to a black-hole route.  And by instantly, I mean in 600 ms.

So, as soon as a spam comes in, I block the entire subnet in less than a second.  Our spammer then tries to send spams over the whole subnet - they are already blocked.  You can't even connect.  I have the ban-time set to 1 year.  I may increase that to 5 years.

Your move spammer.

Hi Remuflon,

Thanks for sharing the knowledge. I support that idea and request you to raise it as a feature request here.

Thanks

Hi sachingurung,

I'm planning to do the feature request.

One small issue I found though, the version of iptables used by Sophos seems to be old.

It does not support the '-w' command, which is used to lock iptables for multiuser use.  This would have been nice when sharing iptables between UTM and Fail2ban. It still works without it, but it is not the ideal configuration.