Blocking SMTP connection automatically
I am running exim on my lindoe and I am seeing a lot of spammer trying to send emails to non-existing address; and some are trying to send many emails at a time.
I am wondering, in general, is there any way that I can automatically block such bad IP's SMTP connections from iptables? Ie: automatically create an iptable rule on the mail port when XX amounts of bad connections on exim are found.
Thanks for help.
Kevin
3 Replies
As a side note, are you already using a DNS Blacklist? If not, start: it will help a lot with this kind of stuff, possibly to the point where you don't feel the need for your own. Spamhaus (
I stop a lot of the rest by rejecting connections from IP addresses for which I cannot successful lookup the host name. You have to whitelist this if you have legitimate senders who cannot / will not set up their mail systems correctly.
Auto written firewall rules can leave you vulnerable to a DoS attack using forged IP headers unless the 'rules for writing the rules' are chosen very carefully.
Thanks,
Kevin