Hi,
I need to block those ip making email spam for "MikroTik RouterOS 6.12".
Can anyone help me create this rule?
Thanks in advance!
Best regards,
Re: Blacklisting SPAM
Where do you have spammers address list from ? How this list looks like ?
If you have such list you can use as it is described in this thread http://forum.mikrotik.com/viewtopic.php?t=98804
If you have such list you can use as it is described in this thread http://forum.mikrotik.com/viewtopic.php?t=98804
Re: Blacklisting SPAM
Hi BartoszP, thanks for your prompt response.Where do you have spammers address list from ? How this list looks like ?
If you have such list you can use as it is described in this thread http://forum.mikrotik.com/viewtopic.php?t=98804
Thats the thing. I dont have such list.
I manage a network of almost 500 private IPs. Yesterday night I got an email from my ISP, they have detected SPAM coming from my public IP.
Im wondering how to detect and black list those IPs, otherwise my ISP may block my IP.
Thanks!!
Re: Blacklisting SPAM
You need make rule which records source addresses for clents with traffic to SMTP ports.
Then you need to make decision if each particular value is "good" ... it means if such client makes esonable SMTP traffic or exceeds it and is SUSPECTED. Check if client sends to spammers addresses or there are connections from these addresses to client IP as it could mean that some PC on client's side could be "zombies" driven by spammers.
You should warn such user about too high traffic as you ISP warns you. You can limit or block SMTP traffic from this particular address till the client confirms you if the traffic is OK or NOT ... You should act as your ISP does.
Check Firewall rules for limiting options: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter
Then you need to make decision if each particular value is "good" ... it means if such client makes esonable SMTP traffic or exceeds it and is SUSPECTED. Check if client sends to spammers addresses or there are connections from these addresses to client IP as it could mean that some PC on client's side could be "zombies" driven by spammers.
You should warn such user about too high traffic as you ISP warns you. You can limit or block SMTP traffic from this particular address till the client confirms you if the traffic is OK or NOT ... You should act as your ISP does.
Check Firewall rules for limiting options: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter
Re: Blacklisting SPAM
Consider simply blocking all outgoing traffic to port 25/tcp. Nowadays there's virtually no good reason for anyone not running a real mail server to make outgoing connections to this port, unless they are spammers.
Re: Blacklisting SPAM
Hi guys,
Is this the rule I need?
Of course I'll then need to evaluate the address and take action.
Thank you alot!!
add chain=tcp protocol=tcp dst-port=25 action=add-src-to-address-list \
comment="add src smtp"
add chain=tcp protocol=tcp dst-port=465 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=587 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=25 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=465 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=587 action=add-src-to-address-list \
comment="add src smtp"
Is this the rule I need?
Of course I'll then need to evaluate the address and take action.
Thank you alot!!
add chain=tcp protocol=tcp dst-port=25 action=add-src-to-address-list \
comment="add src smtp"
add chain=tcp protocol=tcp dst-port=465 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=587 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=25 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=465 action=add-src-to-address-list \
comment="add src smtp"
add chain=udp protocol=udp dst-port=587 action=add-src-to-address-list \
comment="add src smtp"
Re: Blacklisting SPAM
Neither of those ports use udp, only tcp. And you don't need to worry about all of them. Definitely not 587, because it requires authentication and can not be misused by anonymous users. With 465 it's a little grey area, because it's unofficial smtp with ssl without authentication requirements, which theoretically can be misused by anonymous users. But in practice, vast majority of spammers prefer 25.
Re: Blacklisting SPAM
And you can have one rule combined for all
Code: Select all
add chain=udp protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp" Re: Blacklisting SPAM
Great thank you all for helping on this matter!!!!
I'll be posting outcome soon.
I'll be posting outcome soon.
Re: Blacklisting SPAM
"chain=udp" is wrong.And you can have one rule combined for allCode: Select alladd chain=udp protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp"
You can try to block spammers with rules like these:
Code: Select all
[color=black][font=monospace, Courier]/ip firewall filter[/font][/color]
add action=add-src-to-address-list address-list=spammers \
address-list-timeout=3h chain=forward comment=\
"Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=\
25,587 limit=30/1m,0:packet log-prefix=spammer protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
log-prefix=spammer protocol=tcp src-address-list=spammers
And of course, you can modify "address-list-timeout" as needed.
Re: Blacklisting SPAM
My mistake ... easy to fix if someone is following this thread
Code: Select all
add chain=output protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp"
add chain=forward protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp" Re: Blacklisting SPAM
It is absolutely useless to put this rule on output chain. Output chain is from your router to outside. I'm sure your router does not send spam.My mistake ... easy to fix if someone is following this thread
Code: Select alladd chain=output protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp" add chain=forward protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp"
And for what reason you put port 110? It is the port used for the POP3 protocol. Spammers trying to send emails not to download them.
Last edited by grusu on Wed Jun 29, 2016 11:48 pm, edited 1 time in total.
Re: Blacklisting SPAM
Even mikrotik routers are connecting out silently without telling you. It's not useless to have firewall rules in output chain.
Re: Blacklisting SPAM
Hi Jarda,Even mikrotik routers are connecting out silently without telling you. It's not useless to have firewall rules in output chain.
I absolutely agree with you. I have referred strictly to this case.
Re: Blacklisting SPAM
Grusu,And for what reason you put port 110? It is the port used for the POP3 protocol. Spammers trying to send emails not to download them.
A. These rules are just for collecting where to and where from e-mails are send/received but not for blocking. And these rules are not complete ... they are just an idea.
B. What if router NATs or transforms packets ? Then transformed packets IMHO are not in forward chain.
C. As I have wrote in other thread ... let firewall to do it's work .... optimization later.
Re: Blacklisting SPAM
Dont worry I knew it was wrong, but the idea was clear.My mistake ... easy to fix if someone is following this thread
Code: Select alladd chain=output protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp" add chain=forward protocol=tcp dst-port=25,110,465...and_other+ports... action=add-src-to-address-list comment="add src smtp"
So, I created this rule in order to -at least- detect those using smtp:
;;; add src smtp
chain=tcp action=add-src-to-address-list protocol=tcp address-list=add src smtp
address-list-timeout=0s dst-port=25,110,465
Is this right? so far no entry in the address list. any idea?
Re: Blacklisting SPAM
I removed that rule as i had no results, i guess it wast the right "chain".
I then added this two rules and I have some outcome now...
Once again, thank you all for helping on this matter and my apologies for my poor english.
I then added this two rules and I have some outcome now...
And the the entries from the address list are...15 ;;; SPAMERS
chain=output action=add-src-to-address-list protocol=tcp address-list=""
address-list-timeout=3h dst-port=25,110,465
16 ;;; SPAMERS
chain=forward action=add-src-to-address-list protocol=tcp address-list=""
address-list-timeout=3h dst-port=25,110,465
Now I'll monitor their queue for traffic and I may contact them directly to find out where they use those ports intentionally or have become zombies.544 D SPAMERS 10.5.10.234
545 D SPAMERS 10.11.5.172
546 D SPAMERS 10.5.10.40
547 D SPAMERS 190.104.246.162
Once again, thank you all for helping on this matter and my apologies for my poor english.
Re: Blacklisting SPAM
I think I found something,
I now have this IP in the address-list I created for catching the spammers:
557 D SPAMMERS 123.129.65.102
This IP is from outside and its known in many block lists.
I now have this IP in the address-list I created for catching the spammers:
557 D SPAMMERS 123.129.65.102
This IP is from outside and its known in many block lists.
Re: Blacklisting SPAM
Congratulations Mr. Poirot It's time to catch next one ....
It's time to catch next one ....Re: Blacklisting SPAM
Hahahaha!!!! thanks BartoszP!!Congratulations Mr. Poirot
Well, I now have about 100 IPs (external) using this ports.
I want to block them without blocking our internal users.
Could I use this two rules to achieve such security?
/ip firewall filter
add chain=forward protocol=tcp dst-port=25 src-address-list=spammer
action=drop comment="BLOCK SPAMMERS"
add chain=forward protocol=tcp dst-port=25 connection-limit=30,32 limit=50,5 action=add-src-to-address-list
address-list=spammer address-list-timeout=1d comment="Add SMTP spammers"
Who is online
Users browsing this forum: Shambler and 20 guests