From owner-freebsd-questions@FreeBSD.ORG Wed Oct 1 12:13:36 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4F39F16A4B3 for ; Wed, 1 Oct 2003 12:13:36 -0700 (PDT) Received: from mygirlfriday.info (adsl-65-64-145-209.dsl.stlsmo.swbell.net [65.64.145.209]) by mx1.FreeBSD.org (Postfix) with ESMTP id DDA1943FE3 for ; Wed, 1 Oct 2003 12:13:34 -0700 (PDT) (envelope-from gv-mailed@mygirlfriday.info) Received: (qmail 21448 invoked from network); 1 Oct 2003 19:13:03 -0000 Received: from user204.net795.mo.sprint-hsd.net (HELO mygirlfriday.info) (65.41.216.204) by mongo.mygirlfriday.info with DES-CBC3-SHA encrypted SMTP; 1 Oct 2003 19:13:03 -0000 Received: (qmail 21965 invoked by uid 500); 1 Oct 2003 19:13:33 -0000 Message-ID: <20031001191333.21964.qmail@letric.mygirlfriday.info> Date: Wed, 1 Oct 2003 14:13:33 -0500 From: Gary To: FreeBSD References: <20031001181817.21832.qmail@letric.mygirlfriday.info> <20031001182450.GB83044@web.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20031001182450.GB83044@web.ca> User-Agent: Mutt/1.4i Organization: Hardly Subject: Re: Firewall problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Oct 2003 19:13:36 -0000 On Wed, Oct 01, 2003 at 02:24:51PM -0400 or thereabouts, Rob Ellis wrote: > On Wed, Oct 01, 2003 at 01:18:17PM -0500, Gary wrote: > > I am getting a lot of virus activity on my SMTP port 25. So I wanted to > > drop a few IP ranges/addresses.. > > > > 00100 62054 5483792 allow ip from any to any via lo0 > > 00200 0 0 deny ip from any to 127.0.0.0/8 > > 00300 0 0 deny ip from 127.0.0.0/8 to any > > 65000 873327 293931424 allow ip from any to any > > 65100 0 0 deny tcp from 24.92.226.153 to any > > 65110 0 0 deny ip from 213.191.102.86 to any > > 65535 0 0 deny ip from any to any > > > > Yet, checking later in my SMTP logs, I am still getting pounded by the > > listed addresses. Can anyone explain why this isn't working? > > > > Your deny rules have to be added before the 'allow ip from any to any'. > > ipfw add 100 deny tcp from 24.92.226.153 to any Ah, yes, I can see that. Thanks very much guys for your input. Appreciate the input... works well now.. -- Gary