+ Post New Thread
Page 2 of 2 FirstFirst 12
Results 16 to 23 of 23
Enterprise Software Thread, My IP Address Blacklisted (EXternal Exchange) in Technical; the old machine you referring to is the exchange server? do you allow port 25 from client pc's?...
  1. #16

    Join Date
    Dec 2008
    Location
    Essex
    Posts
    2,137
    Thank Post
    1
    Thanked 326 Times in 316 Posts
    Rep Power
    76
    the old machine you referring to is the exchange server?

    do you allow port 25 from client pc's?

  2. #17

    Join Date
    Dec 2011
    Posts
    401
    Thank Post
    368
    Thanked 45 Times in 33 Posts
    Rep Power
    12
    Old machine was my Exchange Server(RIP in flood 03/11/2013), new Exchange Server online 06/11/2013. Teacher Station had malware infection.

    CBL blacklist indicated a connection around 04/11/2013 8:50am, none since then(although infected PC could be off)
    External mail today all seems ok(but still puzzled about errors in audit in the security log)

    Gut feeling it's not Exchange, just a Bot somewhere in my Network, CBL also advised it's not attacking through port 25:

    This was detected by a TCP/IP connection from 109.204.98.18 on port 55750 going to IP address 87.255.51.229 (the sinkhole) on port 80. .

    109.204.98.18 is my external Firewall address, however this is referred in my Exchange security logs in the Event viewer with the my 109.204.98.18 as the source machine?

    Network Information:
    Workstation Name: SRV-EXCHANGE
    Source Network Address: 109.204.98.19
    Source Port: 25591



    Client PCs are allowed to port 25, but could ask my ISP to block this.
    Last edited by MrWu; 10th November 2013 at 01:48 PM.

  3. #18

    Join Date
    Dec 2008
    Location
    Essex
    Posts
    2,137
    Thank Post
    1
    Thanked 326 Times in 316 Posts
    Rep Power
    76
    why are pc's allowed to use port25? they send email via on prem exchange right? using mapi only? or di you use smtp too?

  4. Thanks to sukh from:

    MrWu (10th November 2013)

  5. #19

    Join Date
    Dec 2011
    Posts
    401
    Thank Post
    368
    Thanked 45 Times in 33 Posts
    Rep Power
    12
    Yes they do, I can have this blocked, there's only copiers that need this function for scanning and our finance server

    What do you think about that weird event entry on my exchange server, shall I just delete that user or try and trace?

  6. #20

    Join Date
    Dec 2008
    Location
    Essex
    Posts
    2,137
    Thank Post
    1
    Thanked 326 Times in 316 Posts
    Rep Power
    76
    block 25 on clients and create a relay connector for scanners e tc and restrict via ip.


    can you post the complete event or pm to me.?

  7. Thanks to sukh from:

    MrWu (10th November 2013)

  8. #21

    Join Date
    Dec 2011
    Posts
    401
    Thank Post
    368
    Thanked 45 Times in 33 Posts
    Rep Power
    12
    No problem Sukh; thanks for you help, will pm you the logs for exchange, no queues on the outgoing mail, external ok, just those repeated security events on Exchange...

  9. #22

    Join Date
    Dec 2008
    Location
    Essex
    Posts
    2,137
    Thank Post
    1
    Thanked 326 Times in 316 Posts
    Rep Power
    76
    for some reason I can't see any on PM via Android, will check when by pc....

  10. Thanks to sukh from:

    MrWu (10th November 2013)

  11. #23

    Join Date
    Dec 2011
    Posts
    401
    Thank Post
    368
    Thanked 45 Times in 33 Posts
    Rep Power
    12
    No worries sukh, this forum is awesome, so many good people here. Will freshen up and tackle this tomorrow, 6 weeks of servers all over the place, leaking roof and wet electrics to go!

SHARE:
+ Post New Thread
Page 2 of 2 FirstFirst 12

Similar Threads

  1. Exchange 2010 IP address and mx records
    By superaz300 in forum Enterprise Software
    Replies: 3
    Last Post: 29th June 2012, 10:37 AM
  2. Replies: 5
    Last Post: 7th September 2010, 10:27 AM
  3. Replies: 7
    Last Post: 25th March 2009, 09:38 AM
  4. ISA server 2006 external IP addressing
    By nicholab in forum Windows
    Replies: 1
    Last Post: 12th March 2009, 04:01 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •