On your gateway, it is always a good thing to ban incoming traffic from and to 0.0.0.0 from and to Private ips (10.0.0.0, 192.168.0.0, 172.16. ...)
From your own Ips
To any ip that is not yours
on the ougoing, you need to ban from and to 0.0.0.0 from and to Private ips (10.0.0.0, 192.168.0.0, 172.16. ...) To your own Ips
From any ip that is not yours
Regarding the [0.0.0.0] in imail log, it is not about spoofing it was discussued on this list look at the archive, and the ipswitch knowledge base http://jabba.ipswitch.com/query.html?template=kb&qc=kb+wsftpug+imlguide+wugguide+ftpsrvug+iimguide&col=kb+wsftpug+imlguide+wugguide+ftpsrvug+iimguide&ws=0&qm=0&st=1&nh=10&lk=1&rf=0&oq=&rq=0&qs=&rq=0&qp=&qt=%5B0.0.0.0%5D&qt2=+%7C+imail&Submit=+search+
----- Original Message ----- From: "Cycle Rider" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, September 05, 2004 6:18 PM
Subject: [IMail Forum] Mail Spoofing?
I'm seeing the following entries in my imail log:
09:05 13:02 SMTPD(54b901be00e843e8) [0.0.0.0] connect 206.114.180.92 port 58630
It looks like someone is trying to spoof ip 0.0.0.0?
Is that the correct interpretation of that entry? Should I set my firewall to block all incoming traffic on IP 0.0.0.0? I have the private network ranges blocked at the firewall but not 0.0.0.0
__________________________________ Do you Yahoo!? Yahoo! Mail is new and improved - Check it out! http://promotions.yahoo.com/new_mail
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
