Good morning, I have installed PMG as virtual machine on proxmox VE. The mail gateway 8.2.0 is a virtual machine installed on provmox ve 8.4.1. On the PMG, in Administration -> Syslog I see:
...
May 22 13:27:54 postfix/postscreen[7505]: CONNECT from [165.154.217.217]:51997 to [MY_IP]:25
May 22 13:27:54 postfix/postscreen[7505]: PASS OLD [165.154.217.217]:51997
May 22 13:27:58 postfix/smtpd[8842]: connect from unknown[165.154.217.217]
May 22 13:27:59 postfix/smtpd[8842]: lost connection after AUTH from unknown[165.154.217.217]
May 22 13:27:59 postfix/smtpd[8842]: disconnect from unknown[165.154.217.217] ehlo=1 auth=0/1 commands=1/2
May 22 13:28:00 postfix/postscreen[7505]: CONNECT from [165.154.217.217]:52043 to [MY_IP]:25
May 22 13:28:00 postfix/postscreen[7505]: PASS OLD [165.154.217.217]:52043
May 22 13:28:04 postfix/smtpd[8842]: connect from unknown[165.154.217.217]
...
repeatedly.
Is this behavior, always from the same IP, normal? If not, could you help me to create a firewall configuration/rule (better via GUI), only on this node, to block this IP? Thanks.
...
May 22 13:27:54 postfix/postscreen[7505]: CONNECT from [165.154.217.217]:51997 to [MY_IP]:25
May 22 13:27:54 postfix/postscreen[7505]: PASS OLD [165.154.217.217]:51997
May 22 13:27:58 postfix/smtpd[8842]: connect from unknown[165.154.217.217]
May 22 13:27:59 postfix/smtpd[8842]: lost connection after AUTH from unknown[165.154.217.217]
May 22 13:27:59 postfix/smtpd[8842]: disconnect from unknown[165.154.217.217] ehlo=1 auth=0/1 commands=1/2
May 22 13:28:00 postfix/postscreen[7505]: CONNECT from [165.154.217.217]:52043 to [MY_IP]:25
May 22 13:28:00 postfix/postscreen[7505]: PASS OLD [165.154.217.217]:52043
May 22 13:28:04 postfix/smtpd[8842]: connect from unknown[165.154.217.217]
...
repeatedly.
Is this behavior, always from the same IP, normal? If not, could you help me to create a firewall configuration/rule (better via GUI), only on this node, to block this IP? Thanks.