best way to block IP addresses from talking to our smtp server

[stevenriz]

Hi what would be the best way to block a certain IP address or addresses from communicating with our SMTP server? Currently I would like to block this IP address (198.104.156.37) and do so in IPTABLES but they still seem to get through!! I don't get it. See below at the logwatch file. Things still seem to be getting through. Am I way offbase here in my attempt to block this particular IP address?

I block it before AND after this group of iptable commands

#BLOCK IT HERE
-A RH-Firewall-1-INPUT -p tcp --dport 20:65535 -s 198.104.156.37 -j REJECT --reject-with tcp-reset
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT
#AND TRY AGAIN HERE
-A RH-Firewall-1-INPUT -p tcp --dport 20:65535 -s 198.104.156.37 -j REJECT --reject-with tcp-reset

And still on the logwatch report we see this!!!!

Logged 12207 packets on interface eth0

From 4.78.204.162 - 100 packets to tcp(25)

From 63.123.248.14 - 56 packets to tcp(25)

From 63.123.248.24 - 46 packets to tcp(25)

From 198.104.156.37 - 11913 packets to tcp(25)

From 211.179.169.3 - 79 packets to tcp(25)

From 218.237.66.213 - 13 packets to tcp(25)

 

[jkupski]

This really isn't the right foum for this question--you'd probably get better results in one of the linux forums.

That said, I believe that if you change "-j REJECT --reject-with tcp-reset" to "-j DROP" your problem will be solved. IIRC, rejected packets are logged by default. You can suppress the logging, but I don't recall how off the top of my head.

 

[stevenriz]

you are totally right, sorry... I had "mail" on the brain when I posted this. But thanks for the suggestion. I will try that as well as repost in the linux forum.
Steve