Port 25 Connections Unknown - Should I DROP them?cannot send mail to postfix /w iptables linux proxypostfix smtps issueHow to close an open relay in Postfix?Postfix rejecting mail from authenticated clientsLAMP server domain can't send e-mail to Exchange server domain.. Different IP's but both on same networksaslauthd authentication errorPostfix: Recipient address rejected: Invalid HELO/EHLOEmails are bounced with 'user unknown' when using LDAP in Postfix virtual config554 5.7.1 Relay access denied Postfix Open Relaypostfix: Cannot assign requested address
What did the 'turbo' button actually do?
Navigating a quick return to previous employer
Why'd a rational buyer offer to buy with no conditions precedent?
Why isn't Tyrion mentioned in 'A song of Ice and Fire'?
Why do the i8080 I/O instructions take a byte-sized operand to determine the port?
Is superuser the same as root?
Why did other houses not demand this?
How to create a `range`-like iterable object of floats?
Is there an idiom that means that you are in a very strong negotiation position in a negotiation?
Why is the Eisenstein ideal paper so great?
What is Orcus doing with Mind Flayers in the art on the last page of Volo's Guide to Monsters?
Flatten not working
Moons and messages
Why is std::ssize() introduced in C++20?
Piping the output of comand columns
Why was this character made Grand Maester?
How to escape dependency hell?
Did Game of Thrones end the way that George RR Martin intended?
What is to the west of Westeros?
How to deal with the mirrored components of a FFT? And another question
The disk image is 497GB smaller than the target device
How to teach an undergraduate course without having taken that course formally before?
Did significant numbers of Japanese officers escape prosecution during the Tokyo Trials?
Dad jokes are fun
Port 25 Connections Unknown - Should I DROP them?
cannot send mail to postfix /w iptables linux proxypostfix smtps issueHow to close an open relay in Postfix?Postfix rejecting mail from authenticated clientsLAMP server domain can't send e-mail to Exchange server domain.. Different IP's but both on same networksaslauthd authentication errorPostfix: Recipient address rejected: Invalid HELO/EHLOEmails are bounced with 'user unknown' when using LDAP in Postfix virtual config554 5.7.1 Relay access denied Postfix Open Relaypostfix: Cannot assign requested address
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a Zimbra Mail Server setup, and have noticed quite a few connection attempts on port 25 which are rejected because the reverse lookup fails. Here is an example output:
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: CONNECT from [213.221.224.122]:58241 to [MyInternalIP]:25
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.06 from [213.221.224.122]:58241: EHLO Userrn
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: connect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122]
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: disconnect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122] ehlo=1 quit=1 commands=2
Apr 30 06:04:55 mx1 postfix/postscreen[25405]: CONNECT from [85.234.126.92]:59355 to [MyInternalIP]:25
Apr 30 06:04:56 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.15 from [85.234.126.92]:59355: EHLO Userrn
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: warning: hostname empty.stranzit.ru does not resolve to address 85.234.126.92: Name or service not known
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: connect from unknown[85.234.126.92]
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: disconnect from unknown[85.234.126.92] ehlo=1 quit=1 commands=2
I have looked on the Zimbra Forum, and even posted there, bit no-one seems to know if I should be worried. The posts on this forum reassure me that I should not.
Should I go to the trouble of blocking these IPs either on my router or using the iptables on my firewall, or just ignore them. Sometimes these 'Scans' occur every few seconds or minutes.
iptables postfix firewall email-server zimbra
asked May 9 at 6:55
themetmanthemetman
1
add a comment |
I have a Zimbra Mail Server setup, and have noticed quite a few connection attempts on port 25 which are rejected because the reverse lookup fails. Here is an example output:
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: CONNECT from [213.221.224.122]:58241 to [MyInternalIP]:25
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.06 from [213.221.224.122]:58241: EHLO Userrn
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: connect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122]
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: disconnect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122] ehlo=1 quit=1 commands=2
Apr 30 06:04:55 mx1 postfix/postscreen[25405]: CONNECT from [85.234.126.92]:59355 to [MyInternalIP]:25
Apr 30 06:04:56 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.15 from [85.234.126.92]:59355: EHLO Userrn
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: warning: hostname empty.stranzit.ru does not resolve to address 85.234.126.92: Name or service not known
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: connect from unknown[85.234.126.92]
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: disconnect from unknown[85.234.126.92] ehlo=1 quit=1 commands=2
I have looked on the Zimbra Forum, and even posted there, bit no-one seems to know if I should be worried. The posts on this forum reassure me that I should not.
Should I go to the trouble of blocking these IPs either on my router or using the iptables on my firewall, or just ignore them. Sometimes these 'Scans' occur every few seconds or minutes.
iptables postfix firewall email-server zimbra
asked May 9 at 6:55
themetmanthemetman
1
I forgot to add that checking the WhoIs on most of the addresses I am collecting they are already flagged as 'Abusive'
– themetman
May 9 at 7:15
I consider it the background noise of the internet and when no other actions like brute force login attempts are done (those offending IP-addresses I do block with fail2ban ) I wouldn't worry too much.
– HBruijn
May 9 at 7:17
1
Rather than using comments to add detail you forgot, please use theeditlink below your question.
– HBruijn
May 9 at 7:18
Many thanks for the reassurance, and also for the edit advice. Regards
– themetman
May 9 at 12:43
add a comment |
I have a Zimbra Mail Server setup, and have noticed quite a few connection attempts on port 25 which are rejected because the reverse lookup fails. Here is an example output:
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: CONNECT from [213.221.224.122]:58241 to [MyInternalIP]:25
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.06 from [213.221.224.122]:58241: EHLO Userrn
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: connect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122]
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: disconnect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122] ehlo=1 quit=1 commands=2
Apr 30 06:04:55 mx1 postfix/postscreen[25405]: CONNECT from [85.234.126.92]:59355 to [MyInternalIP]:25
Apr 30 06:04:56 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.15 from [85.234.126.92]:59355: EHLO Userrn
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: warning: hostname empty.stranzit.ru does not resolve to address 85.234.126.92: Name or service not known
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: connect from unknown[85.234.126.92]
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: disconnect from unknown[85.234.126.92] ehlo=1 quit=1 commands=2
I have looked on the Zimbra Forum, and even posted there, bit no-one seems to know if I should be worried. The posts on this forum reassure me that I should not.
Should I go to the trouble of blocking these IPs either on my router or using the iptables on my firewall, or just ignore them. Sometimes these 'Scans' occur every few seconds or minutes.
iptables postfix firewall email-server zimbra
asked May 9 at 6:55
themetmanthemetman
1
I have a Zimbra Mail Server setup, and have noticed quite a few connection attempts on port 25 which are rejected because the reverse lookup fails. Here is an example output:
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: CONNECT from [213.221.224.122]:58241 to [MyInternalIP]:25
Apr 30 06:04:48 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.06 from [213.221.224.122]:58241: EHLO Userrn
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: connect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122]
Apr 30 06:04:48 mx1 postfix/smtpd[4021]: disconnect from 213-221-224-122.static.ftth.fcom.ch[213.221.224.122] ehlo=1 quit=1 commands=2
Apr 30 06:04:55 mx1 postfix/postscreen[25405]: CONNECT from [85.234.126.92]:59355 to [MyInternalIP]:25
Apr 30 06:04:56 mx1 postfix/postscreen[25405]: PREGREET 11 after 0.15 from [85.234.126.92]:59355: EHLO Userrn
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: warning: hostname empty.stranzit.ru does not resolve to address 85.234.126.92: Name or service not known
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: connect from unknown[85.234.126.92]
Apr 30 06:04:56 mx1 postfix/smtpd[4021]: disconnect from unknown[85.234.126.92] ehlo=1 quit=1 commands=2
I have looked on the Zimbra Forum, and even posted there, bit no-one seems to know if I should be worried. The posts on this forum reassure me that I should not.
Should I go to the trouble of blocking these IPs either on my router or using the iptables on my firewall, or just ignore them. Sometimes these 'Scans' occur every few seconds or minutes.
iptables postfix firewall email-server zimbra
iptables postfix firewall email-server zimbra
asked May 9 at 6:55
themetmanthemetman
1
asked May 9 at 6:55
themetmanthemetman
1
asked May 9 at 6:55
themetmanthemetman
1
asked May 9 at 6:55
themetmanthemetman
1
asked May 9 at 6:55
themetmanthemetman
1
1
I forgot to add that checking the WhoIs on most of the addresses I am collecting they are already flagged as 'Abusive'
– themetman
May 9 at 7:15
I consider it the background noise of the internet and when no other actions like brute force login attempts are done (those offending IP-addresses I do block with fail2ban ) I wouldn't worry too much.
– HBruijn
May 9 at 7:17
1
Rather than using comments to add detail you forgot, please use theeditlink below your question.
– HBruijn
May 9 at 7:18
Many thanks for the reassurance, and also for the edit advice. Regards
– themetman
May 9 at 12:43
add a comment |
I forgot to add that checking the WhoIs on most of the addresses I am collecting they are already flagged as 'Abusive'
– themetman
May 9 at 7:15
I consider it the background noise of the internet and when no other actions like brute force login attempts are done (those offending IP-addresses I do block with fail2ban ) I wouldn't worry too much.
– HBruijn
May 9 at 7:17
1
Rather than using comments to add detail you forgot, please use theeditlink below your question.
– HBruijn
May 9 at 7:18
Many thanks for the reassurance, and also for the edit advice. Regards
– themetman
May 9 at 12:43
I forgot to add that checking the WhoIs on most of the addresses I am collecting they are already flagged as 'Abusive'
– themetman
May 9 at 7:15
I forgot to add that checking the WhoIs on most of the addresses I am collecting they are already flagged as 'Abusive'
– themetman
May 9 at 7:15
I consider it the background noise of the internet and when no other actions like brute force login attempts are done (those offending IP-addresses I do block with fail2ban ) I wouldn't worry too much.
– HBruijn
May 9 at 7:17
I consider it the background noise of the internet and when no other actions like brute force login attempts are done (those offending IP-addresses I do block with fail2ban ) I wouldn't worry too much.
– HBruijn
May 9 at 7:17
1
1
Rather than using comments to add detail you forgot, please use the
edit link below your question.– HBruijn
May 9 at 7:18
Rather than using comments to add detail you forgot, please use the
edit link below your question.– HBruijn
May 9 at 7:18
Many thanks for the reassurance, and also for the edit advice. Regards
– themetman
May 9 at 12:43
Many thanks for the reassurance, and also for the edit advice. Regards
– themetman
May 9 at 12:43
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966511%2fport-25-connections-unknown-should-i-drop-them%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966511%2fport-25-connections-unknown-should-i-drop-them%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I forgot to add that checking the WhoIs on most of the addresses I am collecting they are already flagged as 'Abusive'
– themetman
May 9 at 7:15
I consider it the background noise of the internet and when no other actions like brute force login attempts are done (those offending IP-addresses I do block with fail2ban ) I wouldn't worry too much.
– HBruijn
May 9 at 7:17
1
Rather than using comments to add detail you forgot, please use the
editlink below your question.– HBruijn
May 9 at 7:18
Many thanks for the reassurance, and also for the edit advice. Regards
– themetman
May 9 at 12:43