Re: Block outgoing spam from a network using iptables?

[Michele Petrazzo - Unipex <michele.petrazzo@unipex.it>]

Fredrik Strömberg wrote:
> Hello,
> 
> I want to block spam that goes out through the gateway, namely, I 
> want to block certain traffic to dport 25.

> I don´t expect a complete solution, just suggestions and hints. 
> Although, a complete solution would be nice to study and learn from,
>  if someone here is able to do it.
> 

Like now I do the same job with iptables, some per user match rules and
a python parser that make the control of the "iptables -nvL && iptables
-Z" output and send an email to user if the limit are passed

> Maybe logging how many emails is impossible. If so, what is the best
>  solution you can think of that doesn´t involve scanning the
> contents?
> 
> 

a simple iptables -A FORWARD -p tcp --dport 25 -m state --state NEW -j
log --log-prefix "NEW EMAIL" or something like this

> I found this but I don´t understand how it does what he says it does.
>  - http://marti.dimerge.net/blog/tag/ipt_recent :
> 
> modprobe ipt_recent ip_list_tot=32 #ip_list_tot - defines the size of
>  ip_recent file iptables -A FORWARD -p tcp –dport 25 -m recent –name
>  SMTP –seconds 30 –update -j DROP iptables -A FORWARD -p tcp –dport
> 25 -m limit –limit 1/second –limit-burst 5 -j LOG –log-level info 
> –log-prefix “smtp-log ” iptables -A FORWARD -p tcp –dport 25 -m 
> recent –name SMTP –set -j ACCEPT
> 

what's to understand?  if someone send more than one email into the next
30 seconds, the match extension will drop it
have you read the iptables -> recent man page?

Michele