filter mail based on sender's domain

[tdemeyer]

Hi,

I receive a lot of unwanted external mails where the sender's adress is an email adress known to our internal users. As it is impossible for our users to send mails connecting from somewhere outside the domain, I had a rule on our old gateway that says"if there arrives a mail pretending to be from *@ourdomain.com, then reject this mail".
Is this possible to do this with proxmox? I noticed there was an object named "add match field", but I can't find a list of possible fields and filter values...

 

[tdemeyer]

Should this work? create rule
- Inbound
- From: known LDAP address
- To: known LDAP address
- Action: Block

and the same, with idem priority, but
- From: unknown LDAP address (to prevent incoming <anything>@ourdomain.com)

 

[tom]

Hi,

I receive a lot of unwanted external mails where the sender's adress is an email adress known to our internal users. As it is impossible for our users to send mails connecting from somewhere outside the domain, I had a rule on our old gateway that says"if there arrives a mail pretending to be from *@ourdomain.com, then reject this mail".
Is this possible to do this with proxmox? I noticed there was an object named "add match field", but I can't find a list of possible fields and filter values...

hi tim!

do you know SPF? I highly suggest you define an SPF for your domain and activate SPF on your Proxmox (if you deactivated it).

Also, you are using a backup mx for your domain. Most spammer knows this and they sent their spam via the backup mx, working around proxmox.

For improving spam detection, deactivate the backup mx, if you need redundancy, think of building a Proxmox HA Cluster

 

[tdemeyer]

Tom,

Our MX record point to the off-site antivirus scanner (Mc Affee mail4sure service). Our mails arrive at their site, get scanned and are then forwarded to our mail gateway for further processing. Our IP adres is unknown to the outside world, so mail never arrives directly at our proxmox server.

The fact that mails are pre-processed also makes it impossible to use spf.

 

[tom]

Tom,

Our MX record point to the off-site antivirus scanner (Mc Affee mail4sure service). Our mails arrive at their site, get scanned and are then forwarded to our mail gateway for further processing. Our IP adres is unknown to the outside world, so mail never arrives directly at our proxmox server.

The fact that mails are pre-processed also makes it impossible to use spf.

Hi tim,
thanks for clarification. in this setup you you cannot benefit of smtp level spam checks (RBL, SPF and greylisting, Receiver verification). With these smtp level checks a lot of Proxmox users can filter up to 90 % of email before the emails reach their systems. so maybe you should change your setup? btw, proxmox is doing also very reliable virus scanning and if you need you can additionally buy a kaspersky license to add dual layer scanning to your proxmox.

 

[tom]

Should this work? create rule
- Inbound
- From: known LDAP address
- To: known LDAP address
- Action: Block

and the same, with idem priority, but
- From: unknown LDAP address (to prevent incoming <anything>@ourdomain.com)

if you try this, please start NOT with block. just do a notification action to see results, later do a BCC to a archive mailbox or use the quarantine.

 

[tdemeyer]

Our mail gateway only needs to filter forbidden attachments, provide a second layer AV scanning (in fact we have three levels: Mc Affee off-site, Clam on the gateway, and TrendMicro on the internal server.. pretty paranoic .... but we want to be sure )
Our off-site contract is still valid for three more years, so I don't want to waste money by not using their services right now...

Their service is not so good when it comes to filtering attachments. When messages are quarantained, users must have access to a web page, but not all of them are allowed on the internet... That's why we want this type of filtering done on "our side".
The only thing left are the messages as explained in my first post. So I need to find a way to block them with proxmox. (our current gateway with trend-micro running on it does this fine, as i simply have a rule that blocks all sender-from with our domain name in it..)

 

[tdemeyer]

Field names?

Hi All,

Will try to experiment with the object object named "add match field".

Can someone tell me where to find the list of field names I can use?

(can be handy as we also want to filter hotmail senders!)

Tim

 

[tdemeyer]

Sorry, haven't been clear on this in my previous post:

The Manual says:

"Define custom WHO objects, possible values:
...
Add Regular Expression "

I need the field names I can enter here, as there is no list in the manual

 

[tom]

Sorry, haven't been clear on this in my previous post:

The Manual says:

"Define custom WHO objects, possible values:
...
Add Regular Expression "

I need the field names I can enter here, as there is no list in the manual

hi tim,

just see chapter 13.4 in the admin guide. if you just want a who object with hotmail.com, just add the domain to this who object. but be careful with blocking,