New Member

Question

block specific incoming e-mail address

Forum|Forum|18 years ago
May 12, 2008
9 replies
28720 views

Aloha, I' ve perused and searched the forums, but can' t seem to get around this. We have an employee that no longer works here from late 2006 that still receives a fair amount of spam, and well frankly I' m tired of the NDR' s generated by it, so I' ve tried configuring the firewall (An FT-60, firmware 3.00-b0564 (MR5 Patch 1)) to just drop all incoming mail to that account. This is what I' ve done so far, to no avail: AntiSpam -> Black/White List -> E-mail Address -> defined-emailbwl (edit) And added the following: E-mail Address: /mowens@mai-hawaii\.com/i Pattern Type: Regular Expression Action: Mark as Spam Enable: checked and hit " OK" In the Firewall -> Protection Profile -> filter_wizard (edit) I have under Spam Filtering " SMTP" checked (everything under SMTP is checked save for URL check), and in the E-mail address BWL check I have " defined-emailbwl" , and Spam Action set to " Discard" . Under Firewall -> Policy -> wan1->internal, I have a virtual IP forwarding all SMTP traffic to my e-mail server, and the protection profile is set to filter_wizard. I know it' s enabled and catching most of the spam, because I can see via my FortiAnalyzer all the spam that doesn' tget through to my personal account. What is the correct format of the Regular Expression (or should it be Wildcard?) of a specific e-mail address I want the firewall to block? I' ve tried mowens@mai-hawaii.com (Regular & Wildcard), /mowens@mai-hawaii.com/i (Regular) and the latest, /mowens@mai-hawaii\.com/i (Regular), was done via information I' ve taken from these forums. And nothing has given any definitive results. Is there a CLI only setting for this now that perhaps I haven' t come across? Mahalo for any and all help!

rwpatterson

New Member

Try just using the name /mowens/i. The rest is ambiguous. You should only be getting mail for your domain... Note* you could try escaping the @ and the - (\@ and \-), but don' t think that will buy you any mileage...

mauirixxxAuthor

New Member

nope, sending a test e-mail from my google account to mowens@mai-hawaii.com still generated an NDR from my e-mail system. that was with /mowens/i set to Regular Expression. Going to try that as a Wildcard next? *crosses fingers* Thanks rwpatterson (Bob?)! EDIT: Nope, /mowens/i set to Wildcard did nothing also.

rwpatterson

New Member

Are you using the Fortiguard anti-spam feature? Is the license valid? If so, then under Firewall > protection profile > Fortiguard AntiSpam, check that the box under SMTP that relates to the ' E-mail address BWL check' is checked, and that your email BWL is in the drop down box to the right. Also, for wildcard, just use the normal email (mowens@mai-hawaii.com), not the slashes and ' i' . That' s regex stuff. EDIT* Nevermind. I see you' ve done all this stuff already... Try rebooting the box. (If you can during hours) Possibly an upgrade to P4 or P5.

mauirixxxAuthor

New Member

mowens@mai-hawaii.com set to Wildcard did nothing as well :( Oh well, guess I' ll go hit up support, unless you or anyone else has any other suggestions? Thanks again! EDIT: One thing I noticed, is that in the last hour, while the mail is still getting through, it is NOT getting logged by my FortiAnalyzer-100b. I just sent another test mail via my gmail account, and while it generated an NDR via the e-mail server itself, the actual message (nor the NDR got logged). Interesting ... EIDT #2: Ok, guess I was just impatient, both messages finally appeared in the FA-100B after a few minutes. Oh well ...

John_Stoker

Explorer

This is because of the order that the Anti-Spam services are being applied. If he' s coming from mai-hawaii.com and you don' t care about blocking the whole domain, find out the sending IP address and block that in the anti-spam black/white list IP address. This will solve your issue. This is how they used to (and probably still apply the Anti-Spam techniques): 1. IP address BWL check - Last hop IP 2. RBL & ORDBL check IP address FortiShield check HELO DNS lookup 3. E-mail address BWL check 4. MIME headers check 5. IP address BWL check (for IPs extracted from " Received" headers) 6. Return e-mail DNS check, FortiGuard Antispam check (for IPs extracted from " Received" headers, and URLs in email content) 7. Banned word check As you can see the IP address black/white list is first, so if you put the source IP in, it will be caught. This is our experience as we have customers that we are doing this process for. Doesn' t work for yahoo, msn, gmail, etc though because you have to block the Whole domain. Hope this helps! :)

John_Stoker

Explorer

Oh boy! I just re-read your post and I misunderstood the question sorry. I left the post in case anyone else wants the info. As far as blocking a specific destination email address as you mentioned I would talk with support on that. Sorry :(

mauirixxxAuthor

New Member

For anyone interested in how to block a specific incoming e-mail address to your organization, this is the instructions given to me via support ticket, and I have verified that it works for me. To reiterate WHAT I wanted done: I have an ex-employee whose e-mail account regularly gets spam (mowens@mai-hawaii.com), even though the account is no longer valid in our organization. I have set our e-mail server to send my personal account all copies of the NDR' s it generates so I can take appropriate action. So without further ado, here' s what support told me to do (via CLI) # config spamfilter mheader # edit 1 # config entries # edit 1 # set action spam # set fieldbody mowens@mai-hawaii.com # set fieldname /^To$/i # set pattern-type regexp # end # set name mheader_table # end Now, the firewall generates the NDR, and deletes the e-mail (verified via my personal hotmail account). Maybe this information can be put online somewhere, or maybe stickied in the forums?

mauirixxxAuthor

New Member

the above post no longer seems to function in FortiOS v4. Does anyone have a way to block specific incoming address from generating an NDR (basically actually being dropped at the firewall) from my Exchange server? I' m also going to re-open the support ticket and see what they have to say..

A

Anonymous_User

Contributor

The above commands you posted previously should still actually work they have not changed the way the Spamfilter mheader is configured and this has actually remained the same. Check to make sure you have the right settings checked in the protection profile to enable the email to be tagged as Spam When you say it' s not working now what exactly is it doing? Is the email getting through to your Exchange Server and hence an NDR is being sent?

mauirixxxAuthor

New Member

When you say it' s not working now what exactly is it doing? Is the email getting through to your Exchange Server and hence an NDR is being sent?

yes, that' s exactly what is happening, and exactly what I' m trying to prevent. I' ll go over the settings again, to be sure though.

Jan_Scholten

New Member

Isn' t the correct way to not create a ndr? I mean in every " normal" server non existent users should be denied 5XX in the smtp dialog therefore never create a ndr. accepting emails and bounce it afterwards is a very bad behavior as it creates backscatter to probably innocent (cause faked) users..

Schuler

New Member

Hi, why don' t You reject that email with Your internal mailserver? If You have a Exchange 2003 You can enable it with some tricks. See: [link]http://blogs.technet.com/dlemson/archive/2003/10/17/52019.aspx[/link] Regards Sebastian

kwik

New Member

Hi,

How to block everything from one domain example amazon.com, amazon.net, amazon.ru ?

Thank you,

Luk

rwpatterson

New Member

It would help your situation if you open a new post instead of dredging up one that is 6.5 years old that isn't exactly what you're looking for...

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded