Yes you can block subnets / supernets / ip ranges. That's what I do

All done, thanks for your help.

Hi guys,

Sorry to open an old thread, but it seemed appropriate. I'm trying to block a couple of IP addresses (spammers) who are constantly trying to send bulk email to our mail server. Although the server is locked down, its still having to process the crap its being sent therefore I want to stop the traffic on the network edge.

I create an IP Group called Spammers containing a couple of IP Objects representing the IP addresses of the spam servers. I then added a filter to the Default Call Filter and set it Direction: WAN>LAN, Source IP: Spammers, Destination IP: Any, Service Type: Any, Filter: Block Immediately and Log to Syslog. I enabled the filter and sat back to watch what happened.

Well, nothing was logged in my syslog so I checked the mail servers log and saw that the spammers were still trying to make connections. The firewall on the router hadn't stopped anything! Can anyone point out what I'm missing?

Thanks

mstorr wrote: I then added a filter to the Default Call Filter

Put it in the Default Data Filter instead.

if its a dedicated server running linux

setup denyhosts & logwatch