Stop Incoming Email Except from External Spam Filter

[Abhra]

I have a dedicated server which has 20 domains email running using an Exim mail server. Recently I have purchased Barracuda spam filter which pushes all the mail from the network to the offsite server. The problem which I am facing is that even after implementing Spam filter on the network, the spammers can still target the mail server. Hence I want to know if there is any way in which the mail server will only accept mails from the Barracuda and not directly? The version of Exim mail server is 4, WHM and cPanel 11. Any help is highly appreciated.

[Jackson2]

You can block the incoming traffic on the specific port 25 for all the connections available and add only one connection in exception from which the traffic will be allowed.

# iptables -A INPUT -s ! x.x.x.x -p tcp --dport 25 -j REJECT

In the above code, replace the IP address or the range from which the incoming traffic is desired. Hope the post helps. The exclamation marks are important in the code. If they are not included then the code will work other way around.

[Techno01]

Implementing system filters for scanning the incoming mails can be really helpful in your case. System filters scan the emails before the host receives the mail. To set the name of the system filter you have to use system_filter. Define the system filter by entering the commands below and see if the spamming on the mail server is reduced or not.

• system_filter = /etc/mail/exim.filter
• system_filter_user = exim

[Trio]

There is one more approach which you can follow :-
First create two files which contain the list of all the IP addresses which are allowed and the list of all the domains which are allowed. Name them as IPfilter and Domainfilter respectively. Now open the exim.conf file and add the following code :-

hostlist filter_hosts = net-lsearch;/etc/IPfilter :  net-lsearch;/etc/relayhosts
domainlist filter_domains = lsearch;/etc/Domainfilter

Once done save the configuration file and see if it is working.

[Abhra]

Thanks for suggesting some solutions. I tried to block the IP address using the iptables but some of the genuine clients also get blocked because of this and hence I cannot implement it any further. So are there are any more alternate solution for this problem? Do I need to change the configuration of the network? Please help.

[Jackson2]

I am sorry that the solution did not work. You can try this solution and see if it works. Open WHM and go to Exim Configuration Editor and select Advanced Editor. Now add the following code "acl_connect' ACL (before [% ACL_CONNECT_BLOCK %])". Once the code is updated, you can check the functionality of WHM.