Firetrust Support Forums

Hi Nick,

So if "hits" on whiteliste source ip adsress" it will let it in?

or will it contuine to next filter and maybe block on blacklist source email?

yes, it was blocked my "domain suffix"

Hi,

I see that one of the mail is stopped by this reason:
Black Listing From (H): IP(194.63.252.21): 250 ok

But i dont find the ip adress in the RBL servers or in the Blacklist IP list.

Where can i find this?

Eddie

Hi,

a)
I uses many RBL servers.
Can we arrange the servers?

so we have 3 RBL servers

II guess is searche thru nr 1 first?
and then nr 2 , and nr 3?


b)
If Blacklisted in nr1 it stops?
but what if whitelisted in nr1?
check in nr 2? or accepted?


Eddie

tnx, Vacume worked like a charm :-)

Hi,

I see that my mwes.db file is very large.
Its about 5 GB

How can we shrink it?

Eddie

is there any log where i can read the check status? (i dont get the same mail as my users and cannot see whats so special about the mails) I testet: .*\.(zip|exe|com|vbs)$ And this is also stoppig mail that has been forwardet, with a htm and msg attachment. I testet this: (from postfix) [^>]*\.(rar|...

it show :250 2.0.0. OK qued as xxxxxxxx

yes, it could be whitlisted becaused of we have (at last) whitelisted allmost all gmail servers.

how can I see what is has been accepted on?

Eddie

i am agree, but it does not work
I have:
Attachments1 .*\.(zip|exe|com|vbs)$ All fields Regular Expression

I sendt a mail from gmail with "testing.zip" and it passed right thru...

Eddie

Hi,

is there any way to block attachments in MWES?

Eddie

Hi,
yes, i tryed that but it stops many other emails ...

. = any or something in regex , maybe just TEXT not reg.ex?

the best way is to search for http*******zip and use | to add rar|ps1|bat etc etc

what do you think?

tnx :-)

Eddie

Hi,

Did you fix it?
am also testing to add a rexex custom filter to stop email with URL link inside that contain http:// ******* / xxx.zip
but i would likt to search for URL with .ZIP inside..

any idea?

Eddie

Hi Nick, that was the most perfect answer :-) (security is very imported) So what I am doint is grabbing the log and DB files and read them into my dashboard to analyse and check mailes. I then do some analyse thru spf, dmarc dns, reverse lookup etc to show me risky mail and safa mail... Then i have...

hipp hipp, does it use "offset" recalc?

what i need is to know how to generate the resque link.
http://mailserver:4044/Quarantined.srv? Rescue=MTE2NTgx &menu_title=Quarantine&menu_selected=Quarantined&Offset=0#MTE2NTgx

how to know what mail that has "Resque = MTE2NTgx"
is there any DB table or is it generated by something?

Eddie