mail服务器ip被cbl.abuseat.org列入黑名单

yanzhengkai303

我的mail的ip被列入黑名单,我的ip与公网接口ip是一个.
is currently listed in the CBL.

It was detected at 2008-08-20 00:00 GMT (+/- 30 minutes), approximately 2 days, 6 hours, 59 minutes ago.

It has been relisted following a previous removal at 2008-07-11 02:02 GMT

ATTENTION: At the time of detection, this IP was infected with, or NATting for a computer infected with a high volume spam sending trojan - it is participating or facilitating a botnet sending spam or spreading virus/spam trojans.

ATTENTION: if you simply repeatedly remove this IP address from the CBL without correcting the problem, the CBL WILL stop letting you delist it.

This is the Cutwail BOT

You MUST patch your system and then fix/remove the trojan. Do this before delisting, or you're most likely to be listed again almost immediately.

If this IP is a NAT firewall/gateway, you MUST configure the NAT to prevent outbound port 25 connections to the Internet except from your real mail servers.

这已经是第二次了,请问什么原因

jgym

到 cbl.abuseat.org
上 点几下 申请注销 黑名单就行了

apples2010

可能原因：
A. 局域网中某一电脑曾经中过蠕虫病毒，发送大量病毒/垃圾邮件，导致公司出口IP被列入
B. 公司获取的IP前曾经被垃圾制造者利用，被列入RBL

heieye104

是否被人中继了

yang9999

前些时候我这里也是，申请注销了以后，马上又会被加入，我好象试了４，５次后才没再被加入，不过对邮件使用者也要说一下，让大家不要发送跟工作无关的垃圾邮件．

yanzhengkai303

CISCO
These are generally applicable to most (all?) CISCO firewalls:
First you need to create an access list describing the traffic (X.X.X.X is the IP address of your mail server. Add more lines if you have more than one)


access-list acl_out permit tcp host X.X.X.X any eq 25
access-list acl_out deny tcp any any eq 25
... any other outbound rules you may want go here ...
access-list acl_out permit ip any any

Then you need to apply that access-list to the inside interface (because it is being checked on the inside before it goes out)

access-group acl_out in interface inside

我的邮件服务器ip被cbl.abuseat.org列入黑名单了.
网站提示,可以在路由器中这样设置,就是上述的CISCO设置,
第一句这样理解吗?
只允许外网访问内网该ip的25端口,也就只允许内网该ip的25端口可以向外发包吗?
我始终没有明白配置的含义,所以导致我也不能配置好我的ar18-63-1.

yanzhengkai303

cbl.abuseat.org也是这样提示的.
但怎么能够排除这些方面呢.
谢谢.

apples2010

好的策略是你的服务器作为后端，作为局域网内部邮件系统，前端让有实力的邮件服务商去做，这样你只需维护本地邮件的就OK，当然ISP肯定要收费的！

edward_zhf

先管好你的局域网吧，装个网络版的杀毒软件，看看是不是内部先出现了问题。

kks168

同上
可能是邮服或内部机子被中续或中毒