sonicwall

I turned on the RBL on my sonicwall and it appears that ORF is no longer filtering??? When I bring up my orf log viewer there are no entries after the time I enabled the RBL on my firewall.

mark (August 3, 2010)

I don't recall if ORF logs anything whitelisted due to a private or immediate host IP address. If not: is the firewall now acting as an SMTP proxy (stamping its own IP address) rather than a mere pass-through filter (retaining the original "Related IP" / "mail from" IP hop)?

Frank Bernard (August 4, 2010)

@mark : I share Frank's suspicion: Sonicwall probably rewrites the email header, so ORF thinks all emails are originated from the firewall, and since it is considered a trusted host, it ignores them.

Could you paste a sample email header please so we could check the delivery hops? The MIME header can be retrieved by selecting View | Options in Outlook ("Internet Headers"). Here are some instructions on how to get the MIME headers from other email clients: http://www.spamcop.net/fom-serve/cache/19.html

Do you have any tests assigned to On Arrival (Configuration / Tests / Tests)? If yes, ORF should at least log "email whitelisted" at On Arrival... Are you sure the ORF Service is running?

Also, I suggest turning on logging Before Arrival whitelistings and passes to see if any emails passing through the Before Arrival stage (Configuration / Global / Log and events, ORF Text Log > Configure, Events tab).

Krisztian Fekete (ORF Team) (August 4, 2010)
in response to this post

I set the firewall up as an intermediate host and I am now seeing entries in the log file! Thanks!

mark (August 4, 2010)

@mark : Glad to hear the problem has been solved :)

Krisztian Fekete (ORF Team) (August 5, 2010)
in response to this post