Firetrust Support Forums

Does anybody know if I can block multiple domain with a single filter?

riovistade wrote:Does anybody know if I can block multiple domain with a single filter?

Yes, with Regex you can use a single rule. Use |as a separator and make sure that any . are preceded by a \

Single filter... You can have multiple rules in a filter and block one domain per rule with plain text rules.

Single filter, single rule... The regex method is what is needed.


This type of filter is a bit of duplication of the blacklist, if you could describe what you are trying to filter someone might have a good suggestion.

Thanks to Sidewinder & stan_qaz. I had read about the regex method earlier, and I guess I just didn't get it - I do now.

Avoiding an extremely long list of blocked domains in the blacklist is what prompted this querry. I used to use BLScanPlusPro
to consolidate blocked domains into a filter, eliminating long lists, but it won't work anymore. Everything's xml now. So, I was
looking for an automated way to consolidate in xml format. If anyone hears of a program that can do this, please post or email
me.

Thank you

The sed editor will do it, the syntax for the setup is a bit tricky.

http://www.gnu.org/software/sed/manual/sed.html

How effective are the blocked domains at detecting spam without false positives?

I've done a long list of wildcard country domains that does a great job once you remove any countries you get mail from. I added in a few of the odd four letter domains that sometimes send spam too.

One more question if I may please,
Is there a limit on how many domains can be blocked with a single filter?

The only limit we're aware of is a limit on the total number of rules allowed in any one filter. No more than 150 rules - at least for the known future.

WRT the max number of characters IN a given rule: You'd get tired of typing before you hit the max.

QuietOne wrote:The only limit we're aware of is a limit on the total number of rules allowed in any one filter. No more than 150 rules - at least for the known future.

WRT the max number of characters IN a given rule: You'd get tired of typing before you hit the max.

And I still say that's (150) too small - but I'm holding mine to around 100 Rules. When I hit that number, I start looking for ways to split them up.

riovistade wrote:Thanks to Sidewinder & stan_qaz. I had read about the regex method earlier, and I guess I just didn't get it - I do now.

Avoiding an extremely long list of blocked domains in the blacklist is what prompted this querry. I used to use BLScanPlusPro
to consolidate blocked domains into a filter, eliminating long lists, but it won't work anymore. Everything's xml now. So, I was
looking for an automated way to consolidate in xml format. If anyone hears of a program that can do this, please post or email
me.

Thank you

Thinking on this more you should be able to open your blacklist.txt file from the old MW and copy/past into the filters.xml file in the new MW with minimal editing, just keep a backup for safety and watch the syntax tags.

I'd build the basic filter and enter a plain text rule with a dummy expression and one for a regex rule with a dummy expression (include two regex OR conditions so you see how they look) to get the basic format in the file to work with.

Exit both versions of MW to make the file safe to edit!

Make several copies of the rule you are going to work with in the xml file.

Copy the domains you want to block in place of the dummy expression,one per rule for the plaint text option. For the regex option separate them as the dummy did with the | symbol.
There exists a possibility of someone doing some third-party tools to directly access the lists and such as the BLScan app does but so far nobody has been willing to work on that. Nobody probably will do it either, at least until the "feature complete" version is released down the road.

Thanks everyone for your feedback - it is greatly appreciated.

I had already copied & pasted from the old MWP filters.txt file before it was suggested here (I'm
intuitive that way) but the syntax was wrong. Thanks to you guys I have since corrected this.

The filter has only one rule, and is currently blocking in excess of 890 domains, and counting.

Manually adding domains to the filter will have to do untill someone - Firetrust? - automates the process.

Thanks for all your suggestions.