From mboxrd@z Thu Jan 1 00:00:00 1970 From: Deshwal Chand Subject: How can I ask IPTABLES to drop a packet based upon its content Date: Wed, 6 Aug 2003 15:07:31 +0530 Sender: netfilter-admin@lists.netfilter.org Message-ID: <88116A11E9DFD411870900508BEC3831803C2B@CPQ01> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C35BFE.5B8B4320" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: "Netfilter (E-mail)" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C35BFE.5B8B4320 Content-Type: text/plain; charset="iso-8859-1" Hi, I am running IPTABLES on Redhat 7.2 box. We are running a mail server behind this firewall. We receive lot of spam e-mails. Instead of investing into the anti-spam s/w, I want to configure the IPTABLES to read the contents on the packets and drop them based upon the filter defined. Any help ...... Regards, Chand ------_=_NextPart_001_01C35BFE.5B8B4320 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable How can I ask IPTABLES to drop a packet based upon its content =

Hi,

I am running IPTABLES on Redhat 7.2 = box. We are running a mail server behind this firewall. We receive lot = of spam e-mails. Instead of investing into the anti-spam s/w, I want to = configure the IPTABLES to read the contents on the packets and drop = them based upon the filter defined.

Any help ......


Regards,

Chand

------_=_NextPart_001_01C35BFE.5B8B4320-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Leblond Subject: Re: How can I ask IPTABLES to drop a packet based upon its content Date: 06 Aug 2003 11:50:35 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1060163434.13515.17.camel@tech004.alphalink.fr> References: <88116A11E9DFD411870900508BEC3831803C2B@CPQ01> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-ebhSaSNO5AScfU2ehIoR" Return-path: In-Reply-To: <88116A11E9DFD411870900508BEC3831803C2B@CPQ01> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: "Netfilter (E-mail)" --=-ebhSaSNO5AScfU2ehIoR Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, 2003-08-06 at 11:37, Deshwal Chand wrote: > Hi, >=20 > I am running IPTABLES on Redhat 7.2 box. We are running a mail server > behind this firewall. We receive lot of spam e-mails. Instead of > investing into the anti-spam s/w, I want to configure the IPTABLES to > read the contents on the packets and drop them based upon the filter > defined. You can use the the string module to do so (in POM) But a really better choice is to install a spam software like spamassassin. BR, --=20 Eric Leblond Regit.org --=-ebhSaSNO5AScfU2ehIoR Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQA/MM9qnxA7CdMWjzIRAq0oAJ94AiUlNCLOWgSNhW7oRDVl/MCv9QCePdUP /SywyEUq/ePnhDiOMOZJ+Fo= =RkSH -----END PGP SIGNATURE----- --=-ebhSaSNO5AScfU2ehIoR-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Whit Blauvelt Subject: Re: How can I ask IPTABLES to drop a packet based upon its content Date: Wed, 6 Aug 2003 08:53:24 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030806125324.GA6378@china.patternbook.com> References: <88116A11E9DFD411870900508BEC3831803C2B@CPQ01> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <88116A11E9DFD411870900508BEC3831803C2B@CPQ01> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Deshwal Chand Cc: "Netfilter (E-mail)" You might find it much easier, although still a lot of work, to install a relaying mail server on the firewall that uses SpamAssassin and Razor called from the MIMEDefang milter in sendmail. I've also seen a Webpage somewhere on doing this using Qmail and SpamAssassin (you might google for it). This is all free software - the only investment is your time. Asking iptables to do it is putting the load in the wrong place, and failing to take advantage of the work already done in using mail daemons for this task. Whit On Wed, Aug 06, 2003 at 03:07:31PM +0530, Deshwal Chand wrote: > Hi, > > I am running IPTABLES on Redhat 7.2 box. We are running a mail server behind > this firewall. We receive lot of spam e-mails. Instead of investing into the > anti-spam s/w, I want to configure the IPTABLES to read the contents on the > packets and drop them based upon the filter defined. > > Any help ...... > > > Regards, > > Chand From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alistair Tonner Subject: Re: How can I ask IPTABLES to drop a packet based upon its content Date: Wed, 6 Aug 2003 14:01:04 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200308061401.04219.Alistair@nerdnet.ca> References: <88116A11E9DFD411870900508BEC3831803C2B@CPQ01> <20030806125324.GA6378@china.patternbook.com> Reply-To: Alistair@nerdnet.ca Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20030806125324.GA6378@china.patternbook.com> Content-Disposition: inline Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Whit Blauvelt , Deshwal Chand Cc: "Netfilter (E-mail)" On August 6, 2003 08:53 am, Whit Blauvelt wrote: > You might find it much easier, although still a lot of work, to install a > relaying mail server on the firewall that uses SpamAssassin and Razor > called from the MIMEDefang milter in sendmail. I've also seen a Webpage > somewhere on doing this using Qmail and SpamAssassin (you might google for > it). This is all free software - the only investment is your time. > > Asking iptables to do it is putting the load in the wrong place, and > failing to take advantage of the work already done in using mail daemons > for this task. > > Whit > > On Wed, Aug 06, 2003 at 03:07:31PM +0530, Deshwal Chand wrote: > > Hi, > > > > I am running IPTABLES on Redhat 7.2 box. We are running a mail server > > behind this firewall. We receive lot of spam e-mails. Instead of > > investing into the anti-spam s/w, I want to configure the IPTABLES to > > read the contents on the packets and drop them based upon the filter > > defined. > > > > Any help ...... > > > > > > Regards, > > > > Chand Although it was a LOT of work and fair trial for me, (not being a sendmail or QMail guru) I've got Qmail and spamassasin working using the spamassassin filtering for spam and an antivirus scanner working as well... this requires some serious CPU horsepower under load, but in many small business cases can be done with your average desktop class power. I haven't pushed the application yet, but I did grab about 350 mixed test mails and throw them at it once to see how long it would take to process. It loaded the box, and took about 8 minutes to process the works on an AMD 1500 cpu, 756Mb ram, IDE disks and about 75% of that was the time for the AV scanner to process several large zip files, which actually contained virus triggers (not real viruses, but code that should trigger virus scanners) The above has a $0 cost in terms of software code, but can be supported for a nominal fee if required. (and b-t-w it beat the daylights outta the MS implementation that work has.) I REALLY don't recommend using IPTABLES with string matching to try and replace spam filtering. You MIGHT consider using IPTABLES, and RTBH to filter based on ip addresses of known spammers, but I'm not sure that someone has come up with an effective manner of combining these tools yet. -- Alistair Tonner nerdnet.ca Senior Systems Analyst - RSS Any sufficiently advanced technology will have the appearance of magic. Lets get magical!