sonicwall - ORF Forums

sonicwall RSS Back to forum

1

I turned on the RBL on my sonicwall and it appears that ORF is no longer filtering??? When I bring up my orf log viewer there are no entries after the time I enabled the RBL on my firewall.

by mark 9 years ago
2

I don't recall if ORF logs anything whitelisted due to a private or immediate host IP address. If not: is the firewall now acting as an SMTP proxy (stamping its own IP address) rather than a mere pass-through filter (retaining the original "Related IP" / "mail from" IP hop)?

by Frank Bernard 9 years ago
3

@mark: I share Frank's suspicion: Sonicwall probably rewrites the email header, so ORF thinks all emails are originated from the firewall, and since it is considered a trusted host, it ignores them.

Could you paste a sample email header please so we could check the delivery hops? The MIME header can be retrieved by selecting View | Options in Outlook ("Internet Headers"). Here are some instructions on how to get the MIME headers from other email clients: http://www.spamcop.net/fom-serve/cache/19.html

Do you have any tests assigned to On Arrival (Configuration / Tests / Tests)? If yes, ORF should at least log "email whitelisted" at On Arrival... Are you sure the ORF Service is running?

Also, I suggest turning on logging Before Arrival whitelistings and passes to see if any emails passing through the Before Arrival stage (Configuration / Global / Log and events, ORF Text Log > Configure, Events tab).

by Krisztian Fekete (ORF Team) 9 years ago
(in reply to this post)

4

I set the firewall up as an intermediate host and I am now seeing entries in the log file! Thanks!

by mark 9 years ago
5

@mark: Glad to hear the problem has been solved :)

by Krisztian Fekete (ORF Team) 9 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2