Spam Blocker not filtering SMTP mail ?

[nick4660]

Hi,

Just installed UT 6.2 into my small network for it's content filtering capabilities after a long break, I have a perimeter firewall which acts as a router and NAT device.
I then have the UT device acting in 'bridge' mode, after which the network including our email server.

I am running :
Spam blocker
Phish blocker
Spyware Blocker
Virus Blocker
Intrusion Prevention
AdBlocker

the email server is a standard SMTP/IMAP etc server, and all the clients and servers have no issues operating, for all services, including the email server recieving SMTP email, which the clients then connect to by IMAP.

since installing UT the amount of Spam being delivered has increased dramatically into the tens a day.

I have configured SMTP tarpitting, and even tried changing the settings to Very High, with quarantine as the action, all without a change.

then this morning the coffee must have been stronger, as when looking at the spam blocker event log I realised the server IP is the external IP of the perimeter router and the port is IMAP.

am I right in thinking this shows UT is 'only' seeing the IMAP streams as UT is marking emails as Spam ?

Does this show I have got the UT ethernet connections mis-configured in bridge mode ?

the email server is recieving all inbound email is SMTP and this should all be flowing through UT.

I tried installing Web filtering, configured cnn.com to be blocked, sure enough trying to surf, from the internal clients, showed the UT this has been blocked as inappropriate etc page, so I thought this showed it was working ?

Any suggestions, please

Thanks,
nick

[dmorris]

Originally Posted by nick4660

I tried installing Web filtering, configured cnn.com to be blocked, sure enough trying to surf, from the internal clients, showed the UT this has been blocked as inappropriate etc page, so I thought this showed it was working ?

When you did this did you get a pretty block page or an all text one? If its all text then your interfaces are backwards.

Are there any SMTP events in the eventlog?

[nick4660]

well looked pretty
Stop sign icon in the center of the UT grey box, untangle graphical logo, bold text :
This web page was blocked because it is considered inappropriate.

(I have removed the host etc lines to make the post)

I cannot find any smtp events at all, the server column says xxx.xxx.xxx.xxx:143 for all events and nothing in the tarpitting log

[nick4660]

Just to check I swapped the network interface connections, rebooted UT, could not access the mgt login screen and when surfing to the test cnn domain, I got the pure text non-pretty URL block msg.
changed back the interfaces, rebooted, re-checked all things back as they were, with the graphical block page.

[nick4660]

as an update, I omited to state I was running my email server, UT and some more on a VMWare host platform.

I changed the interface for the email server, as I am running a dual homed box, voila, SMTP scanning, filtering, and quarantine all come to live.

Having now beaten myself with the machines power cable, I will live and learn.

Thanks,
nick

[dmorris]

hey nick, thanks for the update! glad you found the issue.

[sky-knight]

HEHE VMWare + UT + being new to either product = HEADACHE!

Don't feel bad man, networks are complex enough without trying to navigate a "virtual network". Especially when a critical portion of said network is a VM.