Ip sendo bloqueado no csf

[Wild2]

Olá esse cliente esta sendo bloqueado todos os dias no csf , nao envia spam nada disso, o volume de emails é alto,envia pelo outlook retorna erro , já passei diversas soluções pro cliente mas ele ainda insiste, gostaria de uma segunda opinião

http://errortools.com/pt/outlook/guide-fixing-0x80042109-error-code/

segue log

189.111.25.32 # lfd: (eximsyntax) Exim syntax errors from 189.111.25.32 (BR/Brazil/189-111-25-32.dsl.telesp.net.br): 10 in the last 3600 secs - Wed Jan 25 07:40:35 2017

2017-01-25 06:55:39 SMTP connection from [189.111.25.32]:49203 (TCP/IP connection count = 2)
2017-01-25 06:55:47 1cWJMl-0006mJ-1m <= [email protected] H=(Compras) [189.111.25.32]:49203 P=esmtpsa X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no A=dovecot_login:[email protected] S=51341 [email protected] T="ENC: Envio de Nota Fiscal Eletr\364nica de Servi\347os para confer\352ncia" for [email protected] [email protected]
2017-01-25 06:55:51 SMTP connection from (Compras) [189.111.25.32]:49203 closed by QUIT
2017-01-25 06:58:20 SMTP connection from [189.111.25.32]:49185 (TCP/IP connection count = 1)
2017-01-25 06:58:26 SMTP call from (AdminPC) [189.111.25.32]:49185 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 06:59:27 SMTP connection from [189.111.25.32]:49200 (TCP/IP connection count = 3)
2017-01-25 06:59:30 SMTP call from (AdminPC) [189.111.25.32]:49200 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:00:29 SMTP connection from [189.111.25.32]:49204 (TCP/IP connection count = 2)
2017-01-25 07:00:42 SMTP call from (AdminPC) [189.111.25.32]:49204 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:01:07 SMTP connection from [189.111.25.32]:49411 (TCP/IP connection count = 1)
2017-01-25 07:01:41 SMTP connection from [189.111.25.32]:49213 (TCP/IP connection count = 2)
2017-01-25 07:02:19 SMTP call from (AdminPC) [189.111.25.32]:49213 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:02:36 1cWJST-0006s1-K3 <= [email protected] H=(Compras) [189.111.25.32]:49411 P=esmtpsa X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no A=dovecot_login:[email protected] S=305027 id=!&!AAAAAAAAAAAYAAAAAAAAAMadqKG+hZVBuLsjOHufLO3CgAAAEAAAAOWjo2DhhTpKrViGzez9hFMBAAAAAA==@xxx.com.br T="RES: Cota\347\343o " for [email protected]
2017-01-25 07:02:45 1cWJTR-0006s1-IH <= [email protected] H=(Compras) [189.111.25.32]:49411 P=esmtpsa X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no A=dovecot_login:[email protected] S=192388 [email protected] T="ENC: NFe Nacional" for [email protected]
2017-01-25 07:02:46 SMTP connection from [189.111.25.32]:49215 (TCP/IP connection count = 2)
2017-01-25 07:02:51 SMTP call from (AdminPC) [189.111.25.32]:49215 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:02:54 1cWJTa-0006s1-Id <= [email protected] H=(Compras) [189.111.25.32]:49411 P=esmtpsa X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no A=dovecot_login:[email protected] S=191920 [email protected] T="ENC: NFe Nacional" for [email protected]
2017-01-25 07:02:57 SMTP connection from (Compras) [189.111.25.32]:49411 closed by QUIT
2017-01-25 07:03:29 SMTP connection from [189.111.25.32]:51556 (TCP/IP connection count = 1)
2017-01-25 07:03:36 1cWJUL-0006xk-PD <= [email protected] H=(Industrial) [189.111.25.32]:51556 P=esmtpsa X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no A=dovecot_login:[email protected] S=111862 [email protected] T="RES: Altera\347\343o embalagens CKD Cap\364 e Transmiss\343o " for [email protected] [email protected] [email protected] [email protected]
2017-01-25 07:03:38 SMTP connection from (Industrial) [189.111.25.32]:51556 closed by QUIT
2017-01-25 07:03:53 SMTP connection from [189.111.25.32]:49217 (TCP/IP connection count = 3)
2017-01-25 07:03:56 SMTP call from (AdminPC) [189.111.25.32]:49217 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:05:09 SMTP connection from [189.111.25.32]:49234 (TCP/IP connection count = 1)
2017-01-25 07:05:13 SMTP call from (AdminPC) [189.111.25.32]:49234 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:06:17 SMTP connection from [189.111.25.32]:49247 (TCP/IP connection count = 5)
2017-01-25 07:06:21 SMTP call from (AdminPC) [189.111.25.32]:49247 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:07:25 SMTP connection from [189.111.25.32]:49250 (TCP/IP connection count = 2)
2017-01-25 07:07:31 SMTP call from (AdminPC) [189.111.25.32]:49250 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:08:33 SMTP connection from [189.111.25.32]:49263 (TCP/IP connection count = 3)
2017-01-25 07:08:37 SMTP call from (AdminPC) [189.111.25.32]:49263 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:08:39 1cWJZH-00075l-F2 <= [email protected] U=root P=local S=2378 T="lfd on server.chservers.com: blocked 189.111.25.32 (BR/Brazil/189-111-25-32.dsl.telesp.net.br)" for root
2017-01-25 07:30:17 SMTP connection from [189.111.25.32]:49303 (TCP/IP connection count = 5)
2017-01-25 07:30:20 SMTP call from (AdminPC) [189.111.25.32]:49303 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:31:24 SMTP connection from [189.111.25.32]:49304 (TCP/IP connection count = 3)
2017-01-25 07:31:27 SMTP call from (AdminPC) [189.111.25.32]:49304 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:32:31 SMTP connection from [189.111.25.32]:49306 (TCP/IP connection count = 5)
2017-01-25 07:32:35 SMTP call from (AdminPC) [189.111.25.32]:49306 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:33:41 SMTP connection from [189.111.25.32]:49307 (TCP/IP connection count = 3)
2017-01-25 07:33:45 SMTP call from (AdminPC) [189.111.25.32]:49307 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:34:49 SMTP connection from [189.111.25.32]:49309 (TCP/IP connection count = 2)
2017-01-25 07:34:52 SMTP call from (AdminPC) [189.111.25.32]:49309 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:35:01 SMTP connection from [189.111.25.32]:63666 (TCP/IP connection count = 3)
2017-01-25 07:35:04 1cWJyq-0007je-6z <= [email protected] H=(LOGISTICA) [189.111.25.32]:63666 P=esmtpsa X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no A=dovecot_login:[email protected] S=3914 [email protected] T="Aceita: alinhamento Vendas" for [email protected]
2017-01-25 07:35:07 SMTP connection from (LOGISTICA) [189.111.25.32]:63666 closed by QUIT
2017-01-25 07:35:45 SMTP connection from [189.111.25.32]:63671 (TCP/IP connection count = 2)
2017-01-25 07:35:48 1cWJzX-0007ks-Qn <= [email protected] H=(LOGISTICA) [189.111.25.32]:63671 P=esmtpsa X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no A=dovecot_login:[email protected] S=9204 [email protected] T="Reuni\343o para apresenta\347\343o de produtos e levantamento de necessidades" for [email protected]
2017-01-25 07:35:51 SMTP connection from (LOGISTICA) [189.111.25.32]:63671 closed by QUIT
2017-01-25 07:35:56 SMTP connection from [189.111.25.32]:49310 (TCP/IP connection count = 2)
2017-01-25 07:36:00 SMTP call from (AdminPC) [189.111.25.32]:49310 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:37:04 SMTP connection from [189.111.25.32]:49312 (TCP/IP connection count = 5)
2017-01-25 07:37:07 SMTP call from (AdminPC) [189.111.25.32]:49312 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:37:12 SMTP connection from [189.111.25.32]:63692 (TCP/IP connection count = 4)
2017-01-25 07:37:17 1cWK0x-0007mO-KO <= [email protected] H=(LOGISTICA) [189.111.25.32]:63692 P=esmtpsa X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=no A=dovecot_login:[email protected] S=27277 id=!&!AAAAAAAAAAAYAAAAAAAAAHuT74Oe0RdEhotdvnJEWIfCgAAAEAAAADgDy6HaBtVFqMogjDFmiFYBAAAAAA==@xxx.com.br T="Valor total di\341rios dos pedidos firmes em carteira" for [email protected] [email protected]
2017-01-25 07:37:19 SMTP connection from (LOGISTICA) [189.111.25.32]:63692 closed by QUIT
2017-01-25 07:38:12 SMTP connection from [189.111.25.32]:49320 (TCP/IP connection count = 5)
2017-01-25 07:38:15 SMTP call from (AdminPC) [189.111.25.32]:49320 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:39:20 SMTP connection from [189.111.25.32]:49321 (TCP/IP connection count = 6)
2017-01-25 07:39:23 SMTP call from (AdminPC) [189.111.25.32]:49321 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:40:27 SMTP connection from [189.111.25.32]:49323 (TCP/IP connection count = 3)
2017-01-25 07:40:31 SMTP call from (AdminPC) [189.111.25.32]:49323 dropped: too many syntax or protocol errors (last command was "RCPT TO: <'[email protected]'>")
2017-01-25 07:40:35 1cWK4B-0007rT-Ej <= root@zzzz U=root P=local S=2378 T="lfd on zzz: blocked 189.111.25.32 (BR/Brazil/189-111-25-32.dsl.telesp.net.br)" for root

 

[Fernando Ferenz]

Coloca o ip dele na whitelist do csf

[Wild2]

o ip é dinamico

[Fernando Ferenz]

Então faz um whois do ip do cliente e adiciona o bloco inteiro.

189.110.0.0/15

Essa faixa pertence TELEFÔNICA BRASIL S.A

[Anger]

Pode também aumentar o numero de conexões para a porta especifica

iptables -A INPUT -p tcp --dport PORTA -m state --state NEW -m recent --update --seconds 120 --hitcount 5 -j DROP

[Wild2]

Agora, Anger disse:

Pode também aumentar o numero de conexões para a porta especifica

iptables -A INPUT -p tcp --dport PORTA -m state --state NEW -m recent --update --seconds 120 --hitcount 5 -j DROP

pode diminuir a intensidade do bloqueio mas vai continuar o problema. acredito que a vivo (telefonica) esteja bloqueando o envio na porta 26, já pedi pro cliente mudar a porta mas ele nao quer, nao sei pq

[Anger]

1 minuto atrás, Wild2 disse:

pode diminuir a intensidade do bloqueio mas vai continuar o problema. acredito que a vivo (telefonica) esteja bloqueando o envio na porta 26, já pedi pro cliente mudar a porta mas ele nao quer, nao sei pq

Se fosse a vivo bloqueando, não iria bloquear no seu serviço.

Quando você desbloqueia, apresenta qual informação ?

[Wild2]

continua enviando até bloquear de novo, realmente nao é da vivo e sim do outlook

[Anger]

8 minutos atrás, Wild2 disse:

continua enviando até bloquear de novo, realmente nao é da vivo e sim do outlook

Qual a mensagem que aparece no CSF quando tu desbloqueia ele ?

[Wild2]

coloquei no post

log no exim_mainlog 

2017-01-25 07:40:35 1cWK4B-0007rT-Ej <= root@zzzz U=root P=local S=2378 T="lfd on zzz: blocked 189.111.25.32 (BR/Brazil/189-111-25-32.dsl.telesp.net.br)" for root

no csf 

189.111.25.32 # lfd: (eximsyntax) Exim syntax errors from 189.111.25.32 (BR/Brazil/189-111-25-32.dsl.telesp.net.br): 10 in the last 3600 secs - Wed Jan 25 07:40:35 2017