1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
###################################################################################################
##
## ATTENTION: This example configuration uses features which require at least postfwd 1.30!
## Please see the manual ('postfwd -m') for example syntax for prior versions.
##
## WARNING: Only provided to show some capabilities of postfwd. Do NOT use this without
## modifications to suit your environment!
##
###################################################################################################
##
## Definitions
##
# Maintenance times
&&MAINTENANCE {
date=15.01.2007
date=15.10.2007 - 17.10.2007
days=Sat-Sun
time=03:00:00 - 04:00:00
}
# Whitelists
&&TRUSTED_NETS {
client_address=192.168.1.0/22
client_address=172.16.128.32/27
}
&&TRUSTED_HOSTS {
client_name~=\.domain1\.net$
client_name~=\.domain2\.de$
}
&&TRUSTED_USERS {
sasl_username==bob
sasl_username==alice
}
&&TRUSTED_TLS {
ccert_fingerprint==11:22:33:44:55:66:AA:BB:CC:DD:EE:FF
ccert_fingerprint==AA:BB:CC:DD:EE:FF:11:22:33:44:55:66
encryption_keysize>=64
}
&&FREEMAIL {
client_name~=\.gmx\.net$
client_name~=\.web\.de$
client_name~=\.(aol|yahoo|h(ush|ot)mail)\.com$
}
&&STATIC {
# contains freemailers
&&FREEMAIL
client_name~=[\.\-]static[[\.\-]
client_name~=^(mail|smtp|mout|mx)[\-]*[0-9]*\.
}
&&DNSWLS {
rbl=list.dnswl.org
rbl=exemptions.ahbl.org
rbl=query.bondedsender.org
rbl=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600
rhsbl_client=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600
}
# Spamchecks
&&BADHELO {
client_name==!!($$(helo_name))
}
&&DYNAMIC {
client_name==unknown
client_name~=(\-.+){4}
client_name~=\d{5}
client_name~=[_\.\-]([axt]{0,1}dsl|br(e|oa)dband|ppp|pppoe|dynamic|dynip|ADSL|dial(up|in)|pool|dhcp|leased)[_\.\-]
}
&&DNSBLS {
rbl=zen.spamhaus.org
rbl=list.dsbl.org
rbl=bl.spamcop.net
rbl=dnsbl.sorbs.net
rbl=ix.dnsbl.manitu.net
rhsbl=rddn.dnsbl.net.au
rhsbl=rhsbl.ahbl.org
rhsbl=rhsbl.sorbs.net
}
##
## Ruleset
##
# temporary reject and drop connection during maintenance window
id=M_001
&&MAINTENANCE
action=421 maintenance - please try again later
# stress-friendly behaviour (will not match on postfix version pre 2.5)
id=STRESS
stress==yes
action=dunno
# Whitelists
id=WL_001
&&TRUSTED_NETS
action=dunno
id=WL_002
&&TRUSTED_HOSTS
action=dunno
id=WL_003
&&TRUSTED_USERS
action=dunno
id=WL_004
&&TRUSTED_TLS
action=dunno
# DNSWL checks - lookup
id=RWL_001
&&DNSWLS
rhsblcount=all ; rblcount=all
action=set(HIT_dnswls=$$rhsblcount,HIT_dnswls+=$$rblcount,DSWL_text=$$dnsbltext)
# DNSWL - whitelisting
id=RWL_002
HIT_dnswls>=2
action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text]
id=RWL_003
HIT_dnswls>=1
action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; &&STATIC
id=RWL_004
HIT_dnswls>=1
action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; $$client_name~=$$(sender_domain)$
# DNSBL checks - lookup
id=RBL_001
&&DNSBLS
rhsblcount=all ; rblcount=all
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,DSBL_text=$$dnsbltext)
# DNSBL checks - evaluation
id=RBL_002
HIT_dnsbls>=2
action=554 5.7.1 blocked using $$DSBL_count dnsbls, INFO: [$$DSBL_text]
id=RBL_003
HIT_dnsbls>=1
&&DYNAMIC
action=REJECT listed on dnsbl and $$client_name looks like dynip, INFO: [$$DSBL_text]
id=RBL_004
HIT_dnsbls>=1
&&BADHELO
action=REJECT listed on dnsbl and $$helo_name does not match $$client_name, INFO: [$$DSBL_text]
# Rate limits
id=RATE_001
HIT_dnsbls>=1
action=rate($$client_address/1/300/450 4.7.1 please do not try more than once per 5 minutes)
id=RATE_002
&&DYNAMIC
action=rate($$client_address/1/300/450 4.7.1 please do not try more than once per 5 minutes)
# Selective greylisting
id=GREY_001
action=dunno
&&STATIC
id=GREY_002
action=dunno
$$client_name~=$$(sender_domain)$
id=GREY_003
action=dunno
HIT_dnswls>=1
id=GREY_004
action=greylisting
&&DYNAMIC
id=GREY_005
action=greylisting
HIT_dnsbls>=1
# Greylisting should be safe during out-of-office times
id=GREY_006
action=greylisting
days=Sat-Sun
id=GREY_007
action=greylisting
days=Mon-Fri
time=!!06:00:00-20:00:00
|
