Blocking Mail / Masquerading

RouterOS Scripting
1

Good day,

Can any body please advise / help me. Every now and then we get a virus and then we get spammed blocked.

We have two domain / mail controllers on our network
Is there away that one can prevent virus software from sending spam via an ip.

The way we operate is that we have the following add:

we have two router (RB1xxx) connecting via fiber cables ( 1G) ports to the internet.
Each router is configured as a train ( A & B main / backup)

The routers are connected via a single ip (local) 41.168.6.130/32 remote 41.168.6.129
That is on ethernet port 1
We also have a 41.168.6.68/25 on ethernet 1

The email servers are 41.168.6.65 and 41.168.6.70
Currently the masquerade is set to masquerade only 10.0.0.0/8. ( coming from ethernet 2)
Some how the ip 41.168.6.130 get blacklisted which means that the the data get masqueraded to ip 41.168.6.130 and not as ip 41.168.6.68
6 chain=srcnat action=masquerade src-address=10.0.0.0/8 src-address-list=!41.168.6.65 out-interface=ether1

Is there any way I can configure the router to only masquerade data from ethernet 2 to ethernet 1 as ip 41.168.6.68 and not to 41.168.6.130?

Attached is the lay out of this site.
screen-capture-4.png

2

Don’t use masquerade. Change the action of that rule to src-nat and manually specify your to-address. “masquerade” is the same as src-nat but automagically picks the to-address, which in your case is the wrong address. Once you manually pick it you have full control over what traffic gets NATed to.

Search the wiki and forums for approaches to preventing machines from sending out mass email. It’s fairly complex a problem and had been covered elsewhere already.

3

Thanks I am a little in doubt:

ip add :

Flags: X - disabled, I - invalid, D - dynamic

ADDRESS NETWORK BROADCAST INTERFACE

0 10.0.0.1/24 10.0.0.0 10.0.0.255 ether2
1 ;;; Sheratin Linen
10.0.1.254/24 10.0.1.0 10.0.1.255 ether3
2 ;;; Bargain Books
192.168.0.1/24 192.168.0.0 192.168.0.255 ether4
3 X 192.168.2.1/24 192.168.2.0 192.168.2.255 ether7
4 ;;; vlan neo-GIDC-2047 as per neotel WDDC1-WDDC1-BWELTTR1
41.168.6.130/32 41.168.6.129 41.168.6.129 ether1
5 10.99.0.1/24 10.99.0.0 10.99.0.255 ether9
6 41.168.6.68/26 41.168.6.64 41.168.6.127 ether1
7 X ;;; HACKER
58.165.177.235/32 58.165.177.235 58.165.177.235 ether1
8 X ;;; HACKER
71.89.70.130/32 71.89.70.130 71.89.70.130 ether1
9 X ;;; HACKER
207.172.52.177/32 207.172.52.177 207.172.52.177 ether1
10 X ;;; HACKER
94.65.88.154/32 94.65.88.154 94.65.88.154 ether1
11 X ;;; HACKER
114.69.128.225/32 114.69.128.225 114.69.128.225 ether1
12 X ;;; HACKER
196.33.166.210/32 196.33.166.210 196.33.166.210 ether1
13 X ;;; Hacker?
155.232.240.19/32 155.232.240.19 155.232.240.19 ether1
14 X ;;; Hacker?
196.33.166.208/32 196.33.166.208 196.33.166.208 ether10
15 X 192.168.99.254/24 192.168.99.0 192.168.99.255 ether13
16 X ;;; HACKER
201.21.35.2/32 201.21.35.2 201.21.35.2 ether1


Routes ip routes:

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 A S ;;; ROute to Internet
0.0.0.0/0 41.168.6.129 1
1 X S ;;; ROute to Internet
0.0.0.0/0 10.0.0.3 1
2 A S ;;; Route to Wireless Network
10.0.0.0/8 10.0.0.2 1
3 ADC 10.0.0.0/24 10.0.0.1 ether2 0
4 ADC 10.0.1.0/24 10.0.1.254 ether3 0
5 X S ;;; Tx Route to Mkb
10.2.0.0/16 10.0.0.4 1
6 A S ;;; Helderberg via Boskloof
10.4.1.0/24 10.0.0.4 1
7 A S 10.4.11.0/24 10.0.0.4 1
8 A S ;;; Via Boskloof
10.4.12.0/24 10.0.0.4 1
9 A S 10.4.16.0/24 10.0.0.4 1
10 A S 10.4.17.0/24 10.0.0.4 1
11 X S 10.6.0.128/32 41.168.6.66 1
12 A S ;;; Hermanus
10.12.0.0/16 10.12.1.1 1
13 ADC 10.12.1.1/32 10.0.0.1 0
14 ADC 10.99.0.0/24 10.99.0.1 ether9 0
15 ADC 41.168.6.64/26 41.168.6.68 ether1 0
16 X S ;;; New Mail server
41.168.6.69/32 10.0.0.2 1
17 A S ;;; Radius server
41.168.6.71/32 10.0.0.2 1
18 A S ;;; Main VOIP
41.168.6.72/32 10.0.0.2 1
19 X S ;;; Test ip
41.168.6.75/32 10.0.0.2 1
20 X S ;;; J Steyn
41.168.6.77/32 10.0.0.2 1
21 A S 41.168.6.78/32 10.0.1.1 1

4

IP fire waal:

/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s
tcp-close-wait-timeout=10s tcp-established-timeout=1d
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=192.169.0.254
add action=reject chain=input comment=Hacker disabled=yes reject-with=
icmp-network-unreachable src-address=99.100.23.157
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=190.47.185.33
add action=drop chain=forward comment=“Spam mailer??” disabled=yes
dst-address=41.168.6.65 dst-port=25 in-interface=ether1 protocol=tcp
src-address=!10.0.0.0/8
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.7.191.18
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.2.16.215
add action=reject chain=input comment=“Spam mailer??” disabled=yes
dst-port=25 in-interface=ether1 protocol=tcp reject-with=
icmp-network-unreachable src-address=74.125.148.11
add action=reject chain=forward comment=“Spam mailer??” disabled=no
dst-port=25 in-interface=ether1 protocol=tcp reject-with=
icmp-network-unreachable src-address=41.0.201.158
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.28.76.13
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.25.35.243
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.28.76.20
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=137.215.6.44
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.220.62.97
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.213.101.154
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=209.203.10.200
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=207.126.147.10
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=207.126.147.13
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=207.126.147.12
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=196.28.76.15
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=77.238.184.241
add action=reject chain=input comment=“Spam mailer??” disabled=no dst-port=
25 in-interface=ether1 protocol=tcp reject-with=icmp-network-unreachable
src-address=207.126.147.14
add action=return chain=srcnat comment=“” disabled=no dst-address=
196.33.159.131 dst-port=25 protocol=tcp
add action=reject chain=input comment=“” disabled=no reject-with=
icmp-network-unreachable src-address=74.208.127.221
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=200.201.180.130
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
211.144.112.20
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=66.246.72.150
add action=reject chain=input comment=“” disabled=no reject-with=
icmp-network-unreachable src-address=222.76.202.167
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=212.24.166.33
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=186.0.97.11
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
41.34.134.26
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
109.159.40.178
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=69.162.114.90
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=59.53.56.148
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=116.55.227.91
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
190.40.243.217
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=85.234.150.230
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
203.223.34.45
add action=reject chain=input comment=Hacker disabled=no in-interface=ether1
reject-with=icmp-network-unreachable src-address=124.132.241.232
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
109.235.50.194
add action=reject chain=input comment=Hacker disabled=no in-interface=ether1
reject-with=icmp-network-unreachable src-address=120.136.17.50
add action=reject chain=input comment=“Hacker??” disabled=no in-interface=
ether1 reject-with=icmp-network-unreachable src-address=88.236.53.20
add action=reject chain=input comment=Hacker disabled=no in-interface=ether1
reject-with=icmp-network-unreachable src-address=58.251.56.233
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=91.220.62.75
add action=reject chain=input comment=Hacker disabled=no reject-with=
icmp-network-unreachable src-address=124.177.31.29
add action=reject chain=srcnat comment=Hacker disabled=no in-interface=ether1
reject-with=icmp-net-prohibited src-address=58.165.177.235
add action=reject chain=output comment=Hacker disabled=no dst-address=
58.165.177.235 reject-with=icmp-port-unreachable
add action=reject chain=srcnat comment=Hacker disabled=no in-interface=ether1
reject-with=icmp-net-prohibited src-address=71.89.70.130
add action=drop chain=forward comment=“Spam mailer??” disabled=yes
dst-address=41.168.6.86 dst-port=25 in-interface=ether1 protocol=tcp
src-address=!10.0.0.0/8
add action=drop chain=forward comment=“Spam mailer??” disabled=yes
dst-port=25 protocol=tcp src-address=41.168.6.86
add action=drop chain=forward comment=Hacker disabled=no protocol=tcp
src-address=88.191.138.141
add action=drop chain=input comment=“” disabled=no dst-port=22 in-interface=
ether1 protocol=tcp src-address=41.168.6.65
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
165.228.161.20
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
207.115.37.20
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
202.67.211.12
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
60.213.50.102
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
82.128.2.26
add action=reject chain=input comment=“Spam mailer??” disabled=no
in-interface=ether1 reject-with=icmp-network-unreachable src-address=
202.67.211.12
/ip firewall nat
add action=dst-nat chain=dstnat comment=“Try BLOCK mail via ip.130” disabled=
no dst-address=0.0.0.0/0 dst-port=25 protocol=tcp src-address=
41.168.6.130 to-addresses=10.0.0.100
add action=masquerade chain=srcnat comment=“” disabled=no src-address=
192.168.99.0/24
add action=passthrough chain=srcnat comment=“” disabled=no out-interface=
ether1 src-address=41.168.6.70 src-address-list=!41.168.6.65
add action=passthrough chain=srcnat comment=“” disabled=no out-interface=
ether1 src-address=41.168.6.65 src-address-list=!41.168.6.65
add action=dst-nat chain=dstnat comment=“First Radius server” disabled=yes
dst-address=41.168.6.65 to-addresses=10.2.16.200
add action=masquerade chain=srcnat comment=“” disabled=no src-address=
192.168.0.0/24
add action=masquerade chain=srcnat comment=“” disabled=no out-interface=
ether1 src-address=10.0.0.0/8 src-address-list=!41.168.6.65
add action=dst-nat chain=dstnat comment=“Second Radius Server” disabled=no
dst-address=41.168.6.73 to-addresses=10.2.16.13
add action=dst-nat chain=dstnat comment=“Main vp” disabled=no dst-address=
41.168.6.72 protocol=udp to-addresses=10.99.0.3
add action=dst-nat chain=dstnat comment=“” disabled=yes dst-address=
196.33.14.74 to-addresses=41.168.6.65
add action=dst-nat chain=dstnat comment=“” disabled=yes dst-address=
196.33.14.74 dst-port=25 protocol=tcp to-addresses=41.148.1.52
add action=dst-nat chain=dstnat comment=Tst disabled=no dst-address=
41.168.6.78 to-addresses=10.0.1.1
add action=dst-nat chain=dstnat comment=“” disabled=yes dst-address=
41.168.6.112 to-addresses=10.2.16.77
add action=masquerade chain=srcnat comment=“” disabled=no src-address=
192.168.2.0/24
add action=dst-nat chain=dstnat comment=“Main vp” disabled=no dst-address=
41.168.6.72 protocol=tcp to-addresses=10.99.0.3
add action=dst-nat chain=dstnat comment=“Sheraton VOIP” disabled=no
dst-address=41.168.6.87 to-addresses=10.0.1.2
add action=dst-nat chain=dstnat comment=“Gr PC” disabled=no dst-address=
41.168.6.93 to-addresses=10.0.0.253
add action=dst-nat chain=dstnat comment=“” disabled=no dst-address=
41.168.6.90 to-addresses=10.0.0.253
add action=dst-nat chain=dstnat comment=“Radius Manager 1 data.theweb.co.za”
disabled=no dst-address=41.168.6.71 to-addresses=10.0.0.240
add action=dst-nat chain=dstnat comment=“Radius Manager 2 data.theweb.co.za”
disabled=no dst-address=41.168.6.76 to-addresses=10.0.0.241
add action=dst-nat chain=dstnat comment=“Radius Manager 2 data.theweb.co.za”
disabled=yes dst-address=41.168.6.91 to-addresses=10.0.0.241
add action=dst-nat chain=dstnat comment=“Woodworth VOIP” disabled=no
dst-address=10.99.0.4 to-addresses=192.168.0.253
add action=dst-nat chain=dstnat comment=“Woodworth VOIP hand sets” disabled=
no dst-address=10.99.0.5 to-addresses=192.168.0.33
add action=src-nat chain=srcnat comment=“” disabled=yes src-address=
10.0.0.0/8 src-address-list=!41.168.6.65 to-addresses=41.168.6.129
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
[grassie@mnr1.theweb.co.za] /ip firewall>


The dude view is 100% the lay out

5

I am also in doubt, because that is quite a mess and hard to read.

Replace your NAT rules that have an action of “masquerade” (which should only be used with interface that receive their IP via DHCP or a PPP process) to have an action of “src-nat”, manually specifying the IP address the router should use to replace the source address with via the “to-address” parameter.

6

I don't know why it cam out the way it did this is all I have. Two masquerade rules.

The two rules are:

This is input from ethernet port 4
add action=masquerade chain=srcnat comment="" disabled=no src-address=
192.168.0.0/24
This is from ethernet port 2
add action=masquerade chain=srcnat comment="" disabled=no out-interface=
ether1 src-address=10.0.0.0/8 src-address-list=!41.168.6.65

Both leaving via ethernet 1

These are the addresses:
Flags: X - disabled, I - invalid, D - dynamic

ADDRESS NETWORK BROADCAST INTERFACE

0 10.0.0.1/24 10.0.0.0 10.0.0.255 ether2
1 ;;; Sheraton
10.0.1.254/24 10.0.1.0 10.0.1.255 ether3
2 ;;; Bargain Books
192.168.0.1/24 192.168.0.0 192.168.0.255 ether4
3 ;;; vlan neo-GIDC-2047 as per neotel WDDC1-WDDC1-BWELTTR1
41.168.6.130/32 41.168.6.129 41.168.6.129 ether1
4 10.99.0.1/24 10.99.0.0 10.99.0.255 ether9
5 41.168.6.68/26 41.168.6.64 41.168.6.127 ether1

screen-capture-5.png
screen-capture-5.png1052×796 94.4 KB