Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
iptables configuration for smtp allow?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Net_Spy
Apprentice
Apprentice


Joined: 29 Dec 2004
Posts: 170

PostPosted: Sun Feb 01, 2009 7:01 am    Post subject: iptables configuration for smtp allow? Reply with quote

Greetings...
I've just installed sendmail along with spamassisn ,dcc and calmav and little tutorial on that so that I prevent my mailserver to get spam let me tell u that I dont have mx record for my mailserver I just need to forward mails on net .

I need a little assistance regarding iptables rule cause I'm new to it . here is my senerio I have test file which include those clients ip whom i wanted to give the access of smtp

10.10.10.30
10.10.10.56

file contains ip address in above format . now all i want is to allow those client via iptables that reads the file and also limit them not to send more then 25 mails in per hours and drop remaining connection who are not in my list . Eth0 is my wan and Eth1 is my lan interface. Looking forward forward for your kind response

Regards
Net_Spy
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1606
Location: U.S.A.

PostPosted: Sun Feb 01, 2009 7:46 am    Post subject: Reply with quote

How to get started with IPTables:
http://security.maruhn.com/

An IPTables primer:
http://www.higherpass.com/linux/Tutorials/Iptables-Primer/1/

A more in-depth IPTables tutorial:
http://iptables-tutorial.frozentux.net/iptables-tutorial.html

IPSets might be useful in the scenario you describe:
http://ipset.netfilter.org/

The netfilter home page -- all kinds of knowledge waiting for your thirsty mind to soak it up like a sponge:
http://www.netfilter.org/

First of all, note that iptables is a "packet filter". It filters packets, not email messages. It doesn't understand the concept of a "mail message", so you can't easily use it to limit people to "25 mails per hour" (as far as I know). You can limit them to X connections per time period, or Y packets (or bytes) per time period. If you really need to limit the number of messages per hour, you should look into using something like procmail.
http://www.procmail.org/

If you do want to use iptables, I would advise you to think in broader terms about what your requirement really is. IPTables has a "limit" match, but to use it for your requirement, you'd have to write one rule per IP address. That's not what you had in mind, I'm sure. You can probably achieve something similar that will be much more efficient by using the "recent" match or the "quota" match (you can read about them in the references).

As to using a separate file, you can use something called "ipsets" that include all the ip addresses. They get stored in RAM very efficiently for extremely rapid processing. If you have a list of many ip addresses to compare to, this would be useful.

IPTables may not be the solution to your requirement. Packet filters aren't very efficient at discriminating automatically between individual remote systems. However, something that does work that way automatically is QOS (i.e. "traffic control", or "traffic shaping"). Traffic shaping, which is a function that involves iptables but happens outside of it, CAN discriminate between individual remote systems, and it even includes "fairness" algorithms (for example, stochastic fairness queing), designed to ensure each system within a class of traffic gets a "fair" share of the bandwidth. It can also limit the rate of traffic from a given source. But again, we're talking about packets or connections here, not "mail messages". At any rate, I mention it because there is probably a way to use traffic shaping to achieve your requirement, although it would be something of a perversion of it's intended function (which is to prioritize traffic and allocate bandwidth).

Bottom line: I would look into using procmail and similar tools. If there's not a canned function to handle what you want, you can easily write a script to do it.
Back to top
View user's profile Send private message
Net_Spy
Apprentice
Apprentice


Joined: 29 Dec 2004
Posts: 170

PostPosted: Sat Feb 07, 2009 7:33 am    Post subject: Reply with quote

I've added few host for spam servers in my sendmails
here are they
Code:

FEATURE(`dnsbl', `zen.spamhaus.org', `"550 Mail from " $`'&{client_addr} " refused - see http://www.spamhaus.org/"')
FEATURE(`dnsbl', `dul.dnsbl.sorbs.net', `"550 Mail from " $`'&{client_addr} " refused - see http://www.dul.dnsbl.sorbs.net/"')
FEATURE(`dnsbl', `bl.spamcop.net', `"450 Mail from " $`'&{client_addr} " refused - see http://spamcop.net/bl.shtml"')


Is there ay other so kindly let me know . Looking forward for your kind response

Regards

Net_Spy
Back to top
View user's profile Send private message
Bones McCracker
Veteran
Veteran


Joined: 14 Mar 2006
Posts: 1606
Location: U.S.A.

PostPosted: Sat Feb 07, 2009 3:34 pm    Post subject: Reply with quote

http://spamlinks.net/filter-dnsbl-lists.htm
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum