Still some other probs |
Post Reply 
|
| Author | |
Norman 
Guest Group 
|
 Post Options
 Thanks(0)
 Quote Reply
 Topic: Still some other probsPosted: 16 October 2003 at 8:40am |
|
I got it working now, mail passes through to my mailserver. internet 25 > firewall > 1025 Spamfilter > 25 mailserver But the problem is it also passes through SPAM :S bl.spamcop.net, true
and localdomain is also correct got Quarantine configured but it just passes through..... |
|
 |
|
|
Desperado
Senior Member 
Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
Post Options
Thanks(0)
Quote Reply
Posted: 16 October 2003 at 10:20pm |
|
Norman, This may be a dumb question. Am I to understand that your firewall is translating to a high port that SpamFilter is then set up to answer on? If so, is the firewall "Transparent" or does SpamFilter think that it is receiving mail from the inside IP of the firewall? If the firewall is NOT transparent, then, depending on your settings, SpamFilter may thing the SMTP connection is comming from an allowed relay IP and all filters will be bypassed. As I said ... this may be a dumb question. Dan S.
|
|
|
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 16 October 2003 at 11:58pm |
|
Norman, Dan has a very valid point in his reply to you. Can you post a section of SpamFilter's activity log (or email it to us at support@logsat.com) so we can take a look? All your incoming connections should be reported as originating from their real IP. If the log shows them coming from your firewall's IP, then you need to reconfigure the firewall so that it does not do IP masking to hide the source IPs. Roberto F. |
|
|
|
|
Norman
Guest Group
|
Post Options
Thanks(0)
Quote Reply
Posted: 18 October 2003 at 7:17am |
|
No it sees the IP of the sender ... so it's external.... Do you have another suggestion ? |
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4106 |
Post Options
Thanks(0)
Quote Reply
Posted: 18 October 2003 at 10:28am |
|
Norman, From your logs we see that during those 3 days all of your emails originated from a series of only 13 different IP addresses: 194.109.xxx.aaa I checked every single one of them, and they are not blacklisted, so none of the MAPS servers will give a positive result. Of those IP, only 3 do not have a reverse DNS. Two of them were indeed quarantined. The third issued two connections, but did not send an email and disconnected. ALL the others pass the tests, so you should have received email from them. Please not that the examples you provided contained very low traffic, since connections from only 13 IPs during 3 days is not a very large quantity. Roberto F. |
|
|
|
|
Desperado
Senior Member
Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
Post Options
Thanks(0)
Quote Reply
Posted: 18 October 2003 at 11:31am |
|
Norman, Looking at the logs, is anything blocking? Have you sent any information to LogSat Support yet? If you want, if you zip up your ini file and your filters I can take a look. If you are getting ZERO blocking, please make sure that there are error messages set up under "custom settings" in the GUI. If these are blank, the SpamFilter will not block anythin. In that case, the best thing to do is to remove everything under "[Error Response]" in the ini file and re-start SpamFilter. This will re-generate the default values as a starting point. Let me know how it is going please. Dan S. (A User ... not LogSat)
|
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.191 seconds.