Forum Discussion

pgopparaju's avatar
pgopparaju
Icon for Nimbostratus rankNimbostratus
Jun 10, 2019

Blocking specific hostnames to send emails through SMTP Realy

Hi,   We use F5 BIG-IP as the SMTP relay and need assistance in blocking specific hostnames to send out emails, i did went through some iRules but couldn't find anything that can help me with and...
AFM
application delivery
BIG-IP
iRules
LTM
pgopparaju's avatar
pgopparaju
Icon for Nimbostratus rankNimbostratus

Kevin,

 

Thanks for the links and i do have a question from the below code which you referenced in the link

 

when CLIENT_ACCEPTED {

log local0. "client accepted"

STREAM::expression {=RCPT TO:<[A-Za-z0-9._%+-]+@(?!(myOKDomain|myOtherOKDomain))[A-Za-z0-9.-]+\.[A-Za-z]{2,4}>=RCPT TO:<mail.bucket@mydomain.org>=}

STREAM::enable

}

when STREAM_MATCHED {

log local0. "Stream filter matched: [STREAM::match]"

}

 

so basically do i just need to replace (myOKDomain|myOtherOKDomain) with our from address hosts which i want to block the email from and everything else is passed through the iRule right?

 

Kevin_Davies's avatar
Kevin_Davies
Icon for MVP rankMVP
Jun 12, 2019

They should be the domains you want to allow.

 

Inside the expression you will see ?!(myOKDomani|myOtherOKDomain). The ! means not. If you want to match bad domains then remove the !. So it becomes ?(badDomain|anotherbadDomain). Then inside the STREAM::expression add the reject command. This means anything that matches will have its connection killed.