Community discussions

 
tncweb
just joined
Topic Author
Posts: 16
Joined: Thu Apr 20, 2006 12:21 am
Location: Nova Scotia, Canada
Contact:

Need help with spammers/viruses

Sat Jan 26, 2008 6:09 pm

We have recently been had our Nat tagged by a botnet. I believe that it started with the w32.stormworm I have had no luck in trapping the data as of yet. And we continue to be black listed by the CBL. I have tried a basic script for smtp traffic but have had no luck. below is the script I currently have running and it is catching some traffic but not all. Any help and or suggestions someone may have would be greatly appreicated. Thanks So Much...

/ip firewall filter

add chain=forward protocol=tcp dst-port=25 src-address-list=spammer
action=drop comment="BLOCK SPAMMERS OR INFECTED USERS"

add chain=forward protocol=tcp dst-port=25 connection-limit=30,32 limit=50,5 action=add-src-to-address-list
address-list=spammer address-list-timeout=1d comment="Detect and add-list SMTP virus or spammers"
 
User avatar
jwcn
Forum Guru
Forum Guru
Posts: 1501
Joined: Sun Aug 27, 2006 6:49 am
Location: Maryland, USA
Contact:

Re: Need help with spammers/viruses

Sat Jan 26, 2008 6:15 pm

wiki.mikrotik.com look at Dmitri's firewall stuff
 
tncweb
just joined
Topic Author
Posts: 16
Joined: Thu Apr 20, 2006 12:21 am
Location: Nova Scotia, Canada
Contact:

Re: Need help with spammers/viruses

Sat Jan 26, 2008 6:25 pm

Thanks I took a look but not having any luck finding his post on wiki do have any url's?
 
User avatar
Aug
Member
Member
Posts: 313
Joined: Thu Jun 07, 2007 2:10 am

Re: Need help with spammers/viruses

Sun Jan 27, 2008 6:21 am

Is the filter not tagging the traffic?
If not, you might try changing "add chain=forward" to "add chain=input"

Torch port 25 and look for the flood of traffic. Block port 25 on the offending IP.

I just finished playing that game. Business client, with about 30 pc's in 4 citys, had an infected machine that was triggering the script and blocking all their outgoing email. Ended up removing the virus for them as well.
Aug
 
User avatar
jwcn
Forum Guru
Forum Guru
Posts: 1501
Joined: Sun Aug 27, 2006 6:49 am
Location: Maryland, USA
Contact:

Re: Need help with spammers/viruses

Mon Jan 28, 2008 12:57 am

 
User avatar
Alessio Garavano
Member
Member
Posts: 304
Joined: Sat May 29, 2004 12:49 am
Location: Corrientes, Argentina
Contact:

Re: Need help with spammers/viruses

Tue Jan 29, 2008 2:55 am

We have recently been had our Nat tagged by a botnet. I believe that it started with the w32.stormworm I have had no luck in trapping the data as of yet. And we continue to be black listed by the CBL. I have tried a basic script for smtp traffic but have had no luck. below is the script I currently have running and it is catching some traffic but not all. Any help and or suggestions someone may have would be greatly appreicated. Thanks So Much...

/ip firewall filter

add chain=forward protocol=tcp dst-port=25 src-address-list=spammer
action=drop comment="BLOCK SPAMMERS OR INFECTED USERS"

add chain=forward protocol=tcp dst-port=25 connection-limit=30,32 limit=50,5 action=add-src-to-address-list
address-list=spammer address-list-timeout=1d comment="Detect and add-list SMTP virus or spammers"
Try removing "limit=50,5" and doing more aggressive connection-limit, can try connection-limit=20,32

Good luck & Regards!
Alessio Garavano
http://www.isparg.com.ar
 
SurferTim
Forum Guru
Forum Guru
Posts: 4637
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: Need help with spammers/viruses

Tue Jan 29, 2008 8:28 pm

Greetings!

I take a "backwards" approach to this challenge. I inform my customers in my "EULA" that port 25 is blocked, and if they use Outlook Express or Thunderbird, they can receive email, but will not be able to send any. The solution through my service is to subscribe to a port 80 email service (webmail). Most reputable ISPs block port 25 from unknown IP addresses for spam relay prevention purposes anyway.

I add this as the first line in my firewall:
/ip firewall filter
add chain=forward protocol=tcp dst-port=25 insert-before=0 action=drop
That should stop all port 25 traffic. Then as each user proves they are not the one:
/ip firewall filter
add chain=forward protocol=tcp dst-port=25 src-address=192.168.xxx.xxx/32 insert-before=0 action=accept
That should allow port 25 through for IP 192.168.xxx.xxx

I do not allow port 25 access to any customers at the present time.

There is a way to force all smtp traffic to a specific server, but I do not use that setting either.
 
Znuff
Member Candidate
Member Candidate
Posts: 139
Joined: Tue Sep 26, 2006 2:42 am
Contact:

Re: Need help with spammers/viruses

Wed Jan 30, 2008 1:55 am

I took a similar approach (block port 25 outgoing) so users can still use SMTPS (over ssl) on different ports, but I've created an address list, so I exclude everyone who requests smtp acces by adding them to that IP list.
/ip firewall filter chain=forward action=reject reject-with=icmp-network-unreachable in-interface=lan dst-port=25 protocol=tcp
src-address-list=!Allow_SMTP
 
tncweb
just joined
Topic Author
Posts: 16
Joined: Thu Apr 20, 2006 12:21 am
Location: Nova Scotia, Canada
Contact:

Re: Need help with spammers/viruses

Wed Jan 30, 2008 3:14 am

Thanks everyone lots of good so I ultimately just decided to block port 25 and open 587 for my users. Thanks for all the good advice.... :D :D :D :D :D :D
 
bokili
Member Candidate
Member Candidate
Posts: 135
Joined: Wed Aug 16, 2006 8:52 pm

Re: Need help with spammers/viruses

Wed Jan 30, 2008 4:14 am

If you use this method in v3 you will encounter problems, as it will block users which doesn't spam randomly. There is something buggy in v3 with this rules.

In our case problem started few days after we upgraded to v3 where we had also this method of indentification of spammers or infected users.

However in v2.9.48 there is no any problem with this.
 
SurferTim
Forum Guru
Forum Guru
Posts: 4637
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: Need help with spammers/viruses

Wed Jan 30, 2008 11:16 am

Just a note: I have found that "drop" is the only defense against the spambots. If you use "reject", the best you can hope for is a standoff with a virus-infected machine. Both machines will eat all your bandwidth with request-reject messages. Make the little suckers wait for a response that will never come!!

EDIT: See post below. I like the tarpit! Thanks!
Last edited by SurferTim on Fri Feb 01, 2008 1:59 pm, edited 1 time in total.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8308
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Need help with spammers/viruses

Fri Feb 01, 2008 1:52 pm

Just a note: I have found that "drop" is the only defense against the spambots. If you use "reject", the best you can hope for is a standoff with a virus-infected machine. Both machines will eat all your bandwidth with request-reject messages. Make the little suckers wait for a response that will never come!!
use 'tarpit', not 'drop' - spambots will be confused ;)
Make the little suckers get ACK response =))
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
GotNet
Member
Member
Posts: 436
Joined: Fri May 28, 2004 7:52 pm
Location: Florida

Re: Need help with spammers/viruses

Wed Feb 06, 2008 7:57 am

Just a note: I have found that "drop" is the only defense against the spambots. If you use "reject", the best you can hope for is a standoff with a virus-infected machine. Both machines will eat all your bandwidth with request-reject messages. Make the little suckers wait for a response that will never come!!
use 'tarpit', not 'drop' - spambots will be confused ;)
Make the little suckers get ACK response =))
Ditto this: Tarpit will sometimes even crash the infected machine.
 
miahac
Long time Member
Long time Member
Posts: 513
Joined: Wed Dec 14, 2005 5:04 pm
Location: Wichita, KS
Contact:

Re: Need help with spammers/viruses

Fri Sep 18, 2009 7:32 pm

any issues using tarpit instead of drop? Stability? CPU load? Network load?
Network Administrator
Kansas Hosting and Wichita Data Centers
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8308
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Need help with spammers/viruses

Fri Sep 18, 2009 8:43 pm

no issues
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.

Who is online

Users browsing this forum: No registered users and 89 guests