Page 2 of 2 FirstFirst 12
Results 11 to 20 of 20
  1. #11
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,486

    Default

    looks to be working fine...

    you just haven't had it block any sessions so there is nothing to report.

    2010-08-02 13:10:41 [RBLChecker] <NT2096705640> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:41 [RBLClient] <NT2096705614> DEBUG <UTThread-1498982>zen.spamhaus.org/95.134.144.45, received confirmation that IP is not on blacklist
    2010-08-02 13:10:41 [RBLChecker] <NT2096705614> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:41 [RBLClient] <NT2096705624> DEBUG <UTThread-1498992>zen.spamhaus.org/41.211.107.148, received confirmation that IP is not on blacklist
    2010-08-02 13:10:41 [RBLChecker] <NT2096705624> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:41 [RBLClient] <NT2096705604> DEBUG <UTThread-1498972>zen.spamhaus.org/24.14.214.24, received confirmation that IP is not on blacklist
    2010-08-02 13:10:41 [RBLChecker] <NT2096705604> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:41 [RBLClient] <NT2096705597> DEBUG <UTThread-1498965>zen.spamhaus.org/193.221.115.2, received confirmation that IP is not on blacklist
    2010-08-02 13:10:41 [RBLChecker] <NT2096705597> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:41 [RBLChecker] <NT2096705651> DEBUG DNSBL: <UTThread-1499019>zen.spamhaus.org/86.28.119.94, wait: 15000
    2010-08-02 13:10:42 [RBLChecker] <NT2096705652> DEBUG DNSBL: <UTThread-1499020>zen.spamhaus.org/195.9.43.193, wait: 15000
    2010-08-02 13:10:42 [RBLClient] <NT2096705651> DEBUG <UTThread-1499019>zen.spamhaus.org/86.28.119.94, received confirmation that IP is not on blacklist
    2010-08-02 13:10:42 [RBLChecker] <NT2096705651> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:42 [RBLClient] <NT2096705652> DEBUG <UTThread-1499020>zen.spamhaus.org/195.9.43.193, received confirmation that IP is not on blacklist
    2010-08-02 13:10:42 [RBLChecker] <NT2096705652> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:42 [RBLClient] <NT2096705598> DEBUG <UTThread-1498966>zen.spamhaus.org/93.17.193.201, received confirmation that IP is not on blacklist
    2010-08-02 13:10:42 [RBLChecker] <NT2096705598> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:42 [RBLChecker] <NT2096705653> DEBUG DNSBL: <UTThread-1499021>zen.spamhaus.org/112.197.151.48, wait: 15000
    2010-08-02 13:10:42 [RBLChecker] <NT2096705654> DEBUG DNSBL: <UTThread-1499022>zen.spamhaus.org/182.52.72.201, wait: 15000
    2010-08-02 13:10:42 [RBLClient] <NT2096705654> DEBUG <UTThread-1499022>zen.spamhaus.org/182.52.72.201, received confirmation that IP is not on blacklist
    2010-08-02 13:10:42 [RBLChecker] <NT2096705654> DEBUG DNSBL: results_size:1
    2010-08-02 13:10:42 [RBLChecker] <NT2096705655> DEBUG DNSBL: <UTThread-1499023>zen.spamhaus.org/86.132.186.48, wait: 15000
    2010-08-02 13:10:42 [RBLClient] <NT2096705655> DEBUG <UTThread-1499023>zen.spamhaus.org/86.132.186.48, received confirmation that IP is not on blacklist
    2010-08-02 13:10:42 [RBLChecker] <NT2096705655> DEBUG DNSBL: results_size:1
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  2. #12
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,486

    Default

    you get LOTs of relay attempts which leads me to be believe you had an open relay at some point...
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  3. #13
    Master Untangler wharfratjoe's Avatar
    Join Date
    Dec 2008
    Location
    Southern California
    Posts
    430

    Default

    what log are these located in? do i have to turn on the debugging to see these and grep for a specific IP if I need to?

  4. #14
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,486

    Default

    in the spam blocker log. they are debug level so you have to turn on debug
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  5. #15
    PCS
    PCS is offline
    Master Untangler
    Join Date
    Mar 2008
    Posts
    189

    Default

    Quote Originally Posted by dmorris View Post
    looks to be working fine...

    you just haven't had it block any sessions so there is nothing to report.
    Something is not right. Before the reinstall I would get hundreds of entries a day. I have had my domain for almost 15 years so I am on a lot of spam lists. I checked two of the IP's you listed at mxtoolbox.com and found they are blacklisted on Spamhaus-Zen.

    41.211.107.148
    24.14.214.24

    I don't know enough about how it works, but it seems like maybe a definition file is corrupted or not updating.

  6. #16
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,486

    Default

    Quote Originally Posted by PCS View Post
    Something is not right. Before the reinstall I would get hundreds of entries a day. I have had my domain for almost 15 years so I am on a lot of spam lists. I checked two of the IP's you listed at mxtoolbox.com and found they are blacklisted on Spamhaus-Zen.

    41.211.107.148
    .
    Interesting, its blacklisted for me:
    [dmorris @ tweek] ~ # host 148.107.211.41.zen.spamhaus.org
    148.107.211.41.zen.spamhaus.org has address 127.0.0.4

    but not for you:
    /var/log/uvm # host 148.107.211.41.zen.spamhaus.org [root @ untangle]
    Host 148.107.211.41.zen.spamhaus.org not found: 3(NXDOMAIN)

    I suspect you're either over some limit such that they aren't returning your DNS queries anymore. I tried changing your DNS to something else, however all queries from your address return NXDOMAIN (not blacklisted)
    Maybe you ISP is filtering these requests...
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  7. #17
    PCS
    PCS is offline
    Master Untangler
    Join Date
    Mar 2008
    Posts
    189

    Default

    I was about to give up until I found this:
    "Spamhaus has banned Google Public DNS resolver queries."

    Yep, if you use Google's public DNS servers, the tarpit RBL will not work. I changed my dns to my ISP's and it started working immediately.

    Thanks for your help Dirk. Gave me a place to start looking.

  8. #18
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,486

    Default

    Quote Originally Posted by PCS View Post
    I was about to give up until I found this:
    "Spamhaus has banned Google Public DNS resolver queries."

    Yep, if you use Google's public DNS servers, the tarpit RBL will not work. I changed my dns to my ISP's and it started working immediately.

    Thanks for your help Dirk. Gave me a place to start looking.
    wow - seriously?
    sigh.

    I tried using 4.2.2.1 directly from your box and it didn't work either though...

    edit: Wow. Thats because 4.2.2.1 appears to be banned too!

    yep, you are right http://www.spamhaus.org/faq/answers....BL%20Usage#261
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

  9. #19
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,546

    Default

    Spamhaus was tired of getting DOS'd from Google?

    I imagine that would be quite a mess. If everyone in the world uses Google, how can they see what is legitimate what what is not? They just see a mass of traffic from Google.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  10. #20
    Untangle Junkie dmorris's Avatar
    Join Date
    Nov 2006
    Location
    San Carlos, CA
    Posts
    17,486

    Default

    I suppose its better than replying that everything is blacklisted!
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself.
    If you need Untangle support please call or email support@untangle.com

Page 2 of 2 FirstFirst 12

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2