We have recently been had our Nat tagged by a botnet. I believe that it started with the w32.stormworm I have had no luck in trapping the data as of yet. And we continue to be black listed by the CBL. I have tried a basic script for smtp traffic but have had no luck. below is the script I currently have running and it is catching some traffic but not all. Any help and or suggestions someone may have would be greatly appreicated. Thanks So Much…
Is the filter not tagging the traffic?
If not, you might try changing “add chain=forward” to “add chain=input”
Torch port 25 and look for the flood of traffic. Block port 25 on the offending IP.
I just finished playing that game. Business client, with about 30 pc’s in 4 citys, had an infected machine that was triggering the script and blocking all their outgoing email. Ended up removing the virus for them as well.
I take a “backwards” approach to this challenge. I inform my customers in my “EULA” that port 25 is blocked, and if they use Outlook Express or Thunderbird, they can receive email, but will not be able to send any. The solution through my service is to subscribe to a port 80 email service (webmail). Most reputable ISPs block port 25 from unknown IP addresses for spam relay prevention purposes anyway.
I took a similar approach (block port 25 outgoing) so users can still use SMTPS (over ssl) on different ports, but I’ve created an address list, so I exclude everyone who requests smtp acces by adding them to that IP list.
If you use this method in v3 you will encounter problems, as it will block users which doesn’t spam randomly. There is something buggy in v3 with this rules.
In our case problem started few days after we upgraded to v3 where we had also this method of indentification of spammers or infected users.
However in v2.9.48 there is no any problem with this.
Just a note: I have found that “drop” is the only defense against the spambots. If you use “reject”, the best you can hope for is a standoff with a virus-infected machine. Both machines will eat all your bandwidth with request-reject messages. Make the little suckers wait for a response that will never come!!
