attack my mail server (help)

[rickygm]

hello forum, for one day is having problems send mail local or external , I make netstat and I see many addresses connected ip to the port 25 of my server trying to send mail to users' account that neither they exist in my domain ,

the account of mail of the postmaster captures all the messages with spam and virus, and I have received as 6000 false mail, that I can make to stop this attack?

in these moments I have closed the port 25 with my firerwall , closing the port, I can send local and external mail, but I cannot receive, because they throw away me the server


comand netstat

tcp 0 0 165.98.245.75:25 220.128.139.82:16284 SYN_RECV
tcp 0 0 165.98.245.75:25 202.64.193.35:22769 SYN_RECV
tcp 0 0 165.98.245.75:25 68.157.67.203:44549 SYN_RECV
tcp 0 0 165.98.245.75:25 69.54.44.97:58832 SYN_RECV
tcp 0 0 165.98.245.75:25 204.181.65.201:24347 SYN_RECV
tcp 0 0 165.98.245.75:25 64.27.109.180:3605 SYN_RECV
tcp 0 0 165.98.245.75:25 212.70.194.252:51828 SYN_RECV
tcp 0 0 165.98.245.75:25 151.189.21.52:56698 SYN_RECV
tcp 0 0 165.98.245.75:25 168.10.57.11:48589 SYN_RECV
tcp 0 0 165.98.245.75:25 200.49.193.136:10575 SYN_RECV
tcp 0 0 165.98.245.75:25 200.193.114.4:4412 SYN_RECV
tcp 0 0 165.98.245.75:25 62.134.61.39:47531 SYN_RECV
tcp 0 0 165.98.245.75:25 65.161.178.162:42424 SYN_RECV
tcp 0 0 165.98.245.75:25 64.80.51.187:12252 SYN_RECV
tcp 0 0 165.98.245.75:25 72.54.161.219:43361 SYN_RECV
tcp 0 0 165.98.245.75:25 213.190.70.31:58170 SYN_RECV
tcp 0 0 165.98.245.75:25 217.156.103.59:40670 SYN_RECV
tcp 0 0 165.98.245.75:25 218.103.63.209:52427 SYN_RECV
tcp 0 0 165.98.245.75:25 212.234.147.107:1179 SYN_RECV
tcp 0 0 165.98.245.75:25 212.102.130.8:41171 SYN_RECV
tcp 0 0 165.98.245.75:25 193.111.200.230:34072 SYN_RECV
tcp 0 0 165.98.245.75:25 210.56.16.62:43181 SYN_RECV
tcp 0 0 165.98.245.75:25 200.110.2.197:41935 SYN_RECV
tcp 0 0 165.98.245.75:25 64.47.55.212:42167 SYN_RECV

[drks]

You should look into adding RBL (Blacklist) lookups to limit mail from known spammers. Additionally, I would modify the postmaster account in /etc/aliases to just junk all mail to postmaster:

postmaster: /dev/null


That might not work for you, but I do not know many people that can say they'd rather deal with the spam than throw away mail for postmaster.

Perhaps if you gave us some information on the following that you are using we can help you lock it down a bit to limit Spam:

Linux Distro / Version
SMTP Mail Server
..etc