The logs on my mail server are full of authorization attempts from bots. Quite often, there will be 100s of attempts in 2 or 3 minutes from the same ip trying various email addresses on both smtp and pop. How do I stop these?
I have the following rules setup in the router to handle the smtp side (note: the actual ip address has been replaced with 1.2.3.4 in this example):
#---- Our outgoing mail server is susceptible to exploit, especially if someone’s email account is compromised. So, let’s block outgoing mail that meets some criteria
add action=add-src-to-address-list address-list=spammers address-list-timeout=3h chain=forward dst-address=1.2.3.4 comment=“Add Spammers to the list for 3 hours” connection-limit=30,32 dst-port=25 limit=20/1m,0 protocol=tcp
add action=drop chain=forward comment=“Avoid spammers action” dst-address=1.2.3.4 dst-port=25 protocol=tcp src-address-list=spammers
The problem is, nothing is ever added to the address-list so the second rule is doing nothing. How do I fix this? I contacted Mikrotik support and this is the response I got:
Please try to use either connection-limit or limit on your rule but not both at the same time.
Really, what I wanted to do was flag any ip addresses that tried, for example, 5 connections in a given time period. The previous rule was not working because it was blocking too many legitimate connections. I could not find the proper combination of connection-limit, packet limit and whatnot. Nothing worked.
Since there is no way to track the number of connections in a given time frame, I did this:
This creates 5 lists – SMTP_Con1 - SMTP_Con5. If an address has not been seen before the time limit, it is added to Con1. If the address connects again and it’s on Con1, it is then added to Con2 and so forth. Then, in the firewall filter, I drop addresses on the Con5 list. This allows four connections from the same ip. Nothing legitimate has been blocked, and it has stopped the spamming/hacking attempts.
The only issue I have right now is that the list timers are reset for each address in each list if that address connects again before the address expires from the list. If anyone has any suggestions for that, I’d appreciate it!