Path: csiph.com!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!news.linkpendium.com!news.linkpendium.com!panix!not-for-mail From: Dale Dellutri Newsgroups: comp.os.linux.networking Subject: Re: Dropping connection attempts to port 25 Date: Mon, 11 Mar 2013 14:58:19 +0000 (UTC) Organization: PANIX Public Access Internet and UNIX, NYC Lines: 24 Message-ID: References: NNTP-Posting-Host: panix1.panix.com X-Trace: reader2.panix.com 1363013899 8011 166.84.1.1 (11 Mar 2013 14:58:19 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Mon, 11 Mar 2013 14:58:19 +0000 (UTC) User-Agent: tin/2.0.0-20110823 ("Ardenistiel") (UNIX) (NetBSD/5.1.2 (i386)) Xref: csiph.com comp.os.linux.networking:2003 On Mon, 11 Mar 2013 10:48:29, Clark Smith wrote: > Somebody keeps trying to connect to my sendmail server, without > success, but filling my logs in the process. Since, according to the > sendmail logs, the connection seems to be coming from a specific IP > address , I added the following IPTables rules: > iptables -A INPUT -s -j DROP > iptables -A OUTPUT -d -j DROP > However, I can still see further connection attempts in the sendmail logs. > Any ideas on how to get IPTables to drop such attempts before > they get to sendmail? Where in the INPUT chain was the first rule added? Was it after a rule which accepts port 25 attempts? Remember that rules are done in order. To get the order of the rules: # iptables -nvL -- Dale Dellutri (lose the Q's)