While this isn't a firewall solution, take a look at MailScanner (www.mailscanner.info) and the IPBlock option therein. I use it.
If a certain site hits my mail server more than X times, based on
where it is coming from in the world, it is blocked in the sendmail
access.db for an hour. It works well for me.


MailScanner also gives you industrial-strength anti-virus and anti-spam
capabilities, by being able to use up to 14 different anti-virus engines,
SpamAssassin, DCC, Razor, and other anti-spam/anti-phishing features.
It is the best thing for email since sliced bread.

Jeff Earickson
Colby College

On Wed, 17 Nov 2004, dave wrote:

Date: Wed, 17 Nov 2004 03:26:40 -0500
From: dave <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: blocking IP based on hits

Hello,
   I've got an ipfilter firewall also providing nat services. It forwards
email to a natted smtp server. This email server is repeatedly getting hit
by IP's atempting to spam it. I was wondering if it's possible either on the
gateway machine or the email server, both are running ipfilter to drop an IP
say for example 192.168.111.222 if it hits, is dropped, reconnects, and so
forth, x times within say a given minute?
Thanks.
Dave.

Reply via email to