On Wed, 17 Nov 2004 21:50:08 +1100 (EST) Darren Reed <[EMAIL PROTECTED]> wrote:
> In some email I received from dave, sie wrote: > [ Charset ISO-8859-1 unsupported, converting... ] > > Hello, > > I've got an ipfilter firewall also providing nat services. It forwards > > email to a natted smtp server. This email server is repeatedly getting hit > > by IP's atempting to spam it. I was wondering if it's possible either on the > > gateway machine or the email server, both are running ipfilter to drop an IP > > say for example 192.168.111.222 if it hits, is dropped, reconnects, and so > > forth, x times within say a given minute? IMHO, it would be possible to log all such connections (at least TCP SYN packets), then periodically check the threshold and change the firewall rules on NAT box to block those hosts at all. But this is not IPFilter-related solution. -- Mishka.
