Problem with firewall filters

gerta · August 25, 2011, 2:07pm

Hi everybody,

I have configured a firewall Filter to add src address to address list , if 3 smtp connections are open as below:

chain=forward action=add-src-to-address-list protocol=tcp src-address=0.0.0.0/0
address-list=Spammers address-list-timeout=1h dst-port=25 connection-limit=3,32

But it doesnt work, because in Spammers address List i dont have any of the IP-s. Meanwhile with Torch i see a lot of ip addresses with SMTP connection open > 3.
When i disable the connection-limit, then i have addresses in Spammers.

The mikrotik is upgraded to the latest firmware and is 2282 Model

Thank you

Caci99 · August 25, 2011, 10:56pm

remove the “src-address=0.0.0.0/0” from the rule, and see what happens.

gerta · August 26, 2011, 6:52am

Thank for your reply, but is the same thing

I dont know why this is happening with this Mikrotik. Because i have another one and it works there, the same model.

Feklar · August 26, 2011, 1:58pm

Is there a rule further above that one that could be catching those connections? Also have you tried clearing out the connections table inside of the RB so it sees new connections instead of established ones?