Is there any way to stop that silly emails with filtering? With some regexps and smtp proxy filtering or any brigth ideas ?
Gokalp
sorry, RouterOS is not a mailserver.
Well it’s obvious. What i ment was for that specific string “You have received an e-card” we may mark that connection and discard it. There’s is a similar subject although i’m not very sure same procedure apply to that spam bombing.
routeros can look for text strings in a packet. email message consists of a lot of packets, so this would not be possible.
That would be most unwise.
Aside from blocking several popular e-card services you’d even block your ability to post “You have received an e-card” as a string to this forum.
Even though the effects of some problems can be blocked by a firewall, you do nothing to actually solve the problem. Blocking the effects of something and not solving it usually adds overhead, leads to broken behavior, loss of control and causes new effects that must be dealt with inside the firewall.
If you want to filter out “bad” emails from your system you need to look at something like SpamAssassin (or its payed-for brothers).
Install a separate SMTP machine dedicated for incoming emails that runs everything through anti-virus, spam filters etc and then forwards to your internal email servers. That way you will keep your email servers running smothly since the heavy load of filtering / checking is on another machine
/Jörgen
As you mentioned we’re using spamassasin with simscan on our qmail system. And also they’re seperate from our mx servers to decrease the load on mxs.
we’re using the mikrotik in bridge mode and for that seasonal popular spams we don’t want to touch our learning filters on spamassasin server. that was the idea if it’s possible to do such an intervention on firewall.
at the end i did some marking and reject that kind of emails, may be it’s a stupid way but it’ll be active for a couple of weeks anyway.
0 chain=prerouting in-interface=External dst-address=xx.yy.tt.zz protocol=tcp dst-port=25
content=You have received an e-card action=mark-connection new-connection-mark=test passthrough=yes
1 ;
chain=prerouting in-interface=External connection-mark=test action=mark-packet new-packet-mark=testpacket
passthrough=no
Then in the forward chain i’m rejecting the market packet.
You could run into problems with this approach as the sending server is going to continually retry sending the email. Not too bad if it’s only one mail, but, if you’ve got 7 days worth and a lot of users…
You don’t need to touch the learning part of SpamAssassin. Just put a local rule in the config file.
Regards
Andrew