0
DROP       all  --  114-43-XXX-XXX.dynamic.hinet.net  anywhere
DROP       all  --  118-161-XXX-XXX.dynamic.hinet.net  anywhere

These are just two of the several restrictions I have in IPTables right now because this person is constantly connecting to postfix. Luckily, the server does not allow him to send messages because relay access is denied. I would still like to block this person from accessing my server. Is there a way to block the whole group of IP's using dynamic.hinet.net instead of specifying IP Addresses everytime?

  • 1
    Please use the contact page to request that this profile be merged with your existing profile. Thank you! – Chris S Jun 23 '14 at 15:34
3

It's not a single person or a single PC you're seeing. It's just infected clients with botnets, which spammers use to find open relays so that they can send their junk. Keep the server running for a few months without deleting logs, and you'll find millions of them.

I suggest that you make 100% sure that your server does not allow relaying, and that you install simple extensions to your mail server to block of 99% of the attempts without filling your iptables ruleset.

The ones that come to mind:

  • Strict SPF checking
  • RBL's
  • DKIM (not widely adopted yet)

All these provide very little overhead - everything is based on DNS which is an excellent transport for these kind of services. Make sure you use a DNS server that has a large cache available (like Googles).

  • Absolutely no need to use IpTables for a relay check - postfix can do that as easy and as well. Well said. – TomTom Jun 23 '14 at 14:57
  • I would mark this as answer but I don't see the button. Presumably because not enough time has elapsed? – Justin E Jun 23 '14 at 14:59
  • @JustinE Are you "jxrts"? If so then you're logged in with the wrong account.. – pauska Jun 23 '14 at 15:02
  • Just logged in after asking the question because it didn't do it automatically...that's weird...the question was asked as a guest, and when I "completed the registration" it said the account already existed, so I logged in. I figured it would transfer the question to my account, but I guess not...just flagged for a moderator to look at it. – Justin E Jun 23 '14 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.