It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda NextGen Firewall X

How to add the Barracuda RBL to the NG Firewall SPAM filter (spamassassin)

  • Type: Knowledgebase
  • Date changed: one year ago
Solution #00005321 

 
Scope:
This solution replies to:
- NG Firewall firmware versions 4.2.x, 5.0.x, 5.2.x
- netfence firmware versions 4.2.x

 
Symptoms:
Barracuda Networks provide a RBL for spamfilter. It is possible to add this RBL to the NG Firewall SPAM filter (spamassassin). 

 
Solution:
Just enter this line ins the SPAM rules to enable the Barracuda RBL.

header IN_BCUDA_RBL rbleval:check_rbl('bcuda', 'b.barracudacentral.org')
describe IN_BCUDA_RBL Received via a relay listed by Barracuda BRBL
tflags IN_BCUDA_RBL net

header RCVD_IN_BCUDA_RELAY rbleval:check_rbl_results_for('bcuda', '127.0.0.2')
describe RCVD_IN_BCUDA_RELAY BCUDA: relay ip is convicted spammer
tflags RCVD_IN_BCUDA_RELAY net

score RCVD_IN_BCUDA_RBL 1.00
score RCVD_IN_BCUDA_RELAY 1.00 


Useful for querying against DNS lists which list dialup IP addresses; the first hop may be a dialup, but as long as there is at least one more hop, via their outgoing SMTP server, that's legitimate, and so should not gain points. If there is only one hop, that will be queried anyway, as it should be relaying via its outgoing SMTP server instead of sending directly to your MX.

header IN_BCUDA_HOP rbleval:check_rbl('bcuda-notfirsthop', 'b.barracudacentral.org')

describe IN_BCUDA_HOP Received via a relay listed by Barracuda BRBL

tflags IN_BCUDA_HOP net


score RCVD_IN_BCUDA_HOP 1.00


In this example the score value "1" will be used, when the RBL match. You may check the mailgateway logfile for following messages to be sure, that the RBL were used.

201003 31 11:54:06    Info   +0200 212.227.126.171:51619 SPAM Report: *  1.0 IN_BCUDA_RBL RBL: Received via a relay listed by Barracuda BRBL
201003 31 11:54:06    Info   +0200 212.227.126.171:51619 SPAM Report: *  [xx.xx.xx.xx listed in b.barracudacentral.org]
201003 31 11:54:06    Info   +0200 212.227.126.171:51619 SPAM Report: *  1.0 RCVD_IN_BCUDA_RELAY RBL: BCUDA: relay ip is convicted spammer
201003 31 11:54:06    Info   +0200 212.227.126.171:51619 SPAM Report: *  0.0 HTML_MESSAGE BODY: HTML included in message

 


Link to This Page:
https://campus.barracuda.com/solution/50160000000IKbqAAG