I got it working now, mail passes through to my mailserver.

internet 25 > firewall > 1025 Spamfilter > 25 mailserver

But the problem is it also passes through SPAM :S
I got about 6 MAPS servers that would be these,

bl.spamcop.net, true
sbl.spamhaus.org, true
spam.dnsrbl.net, true
dnsbl.njabl.org, true
relays.ordb.org, true
list.dsbl.org, true
blackholes.easynet.nl, true

and localdomain is also correct got Quarantine configured but it just passes through.....

Norman,

This may be a dumb question.  Am I to understand that your firewall is translating to a high port that SpamFilter is then set up to answer on?  If so, is the firewall "Transparent" or does SpamFilter think that it is receiving mail from the inside IP of the firewall?  If the firewall is NOT transparent, then, depending on your settings, SpamFilter may thing the SMTP connection is comming from an allowed relay IP and all filters will be bypassed.

As I said ... this may be a dumb question.

Dan S.

Norman,

Dan has a very valid point in his reply to you. Can you post a section of SpamFilter's activity log (or email it to us at mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com ) so we can take a look? All your incoming connections should be reported as originating from their real IP. If the log shows them coming from your firewall's IP, then you need to reconfigure the firewall so that it does not do IP masking to hide the source IPs.

Roberto F.
LogSat Software

No it sees the IP of the sender ... so it's external....
Still getting lots and lots of spam :(

Do you have another suggestion ?

Norman,

From your logs we see that during those 3 days all of your emails originated from a series of only 13 different IP addresses:

194.109.xxx.aaa
194.109.xxx.bbb
194.109.xxx.ccc
194.109.xxx.ddd
194.109.xxx.eee
194.109.xxx.fff
194.109.xxx.ggg
206.128.xxx.yyy
208.31.xxx.yyy
212.46.xxx.yyy
218.70.xxx.yyy
220.116.xxx.yyy
62.195.xxx.yyy

I checked every single one of them, and they are not blacklisted, so none of the MAPS servers will give a positive result.

Of those IP, only 3 do not have a reverse DNS. Two of them were indeed quarantined. The third issued two connections, but did not send an email and disconnected.

ALL the others pass the tests, so you should have received email from them.

Please not that the examples you provided contained very low traffic, since connections from only 13 IPs during 3 days is not a very large quantity.

Roberto F.
LogSat Software

Norman,

Looking at the logs, is anything blocking? Have you sent any information to LogSat Support yet?  If you want, if you zip up your ini file and your filters I can take a look.  If you are getting ZERO blocking, please make sure that there are error messages set up under "custom settings" in the GUI.  If these are blank, the SpamFilter will not block anythin.  In that case, the best thing to do is to remove everything under "[Error Response]" in the ini file and re-start SpamFilter.  This will re-generate the default values as a starting point.

Let me know how it is going please.

Dan S. (A User ... not LogSat)