Fredrik Strömberg wrote:
Hello,
I want to block spam that goes out through the gateway, namely, I
want to block certain traffic to dport 25.
I don´t expect a complete solution, just suggestions and hints.
Although, a complete solution would be nice to study and learn from,
if someone here is able to do it.
Like now I do the same job with iptables, some per user match rules and
a python parser that make the control of the "iptables -nvL && iptables
-Z" output and send an email to user if the limit are passed
Maybe logging how many emails is impossible. If so, what is the best
solution you can think of that doesn´t involve scanning the
contents?
a simple iptables -A FORWARD -p tcp --dport 25 -m state --state NEW -j
log --log-prefix "NEW EMAIL" or something like this
I found this but I don´t understand how it does what he says it does.
- http://marti.dimerge.net/blog/tag/ipt_recent :
modprobe ipt_recent ip_list_tot=32 #ip_list_tot - defines the size of
ip_recent file iptables -A FORWARD -p tcp –dport 25 -m recent –name
SMTP –seconds 30 –update -j DROP iptables -A FORWARD -p tcp –dport
25 -m limit –limit 1/second –limit-burst 5 -j LOG –log-level info
–log-prefix “smtp-log ” iptables -A FORWARD -p tcp –dport 25 -m
recent –name SMTP –set -j ACCEPT
what's to understand? if someone send more than one email into the next
30 seconds, the match extension will drop it
have you read the iptables -> recent man page?
Michele
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
