what u see, what u learn, 'n what u did

Setting VPN pptp di mikrotik

2010-08-18T08:45:00.002+07:00

Pertama : Setelah kita mendapatkan IP Public, selanjutnya kita akan melakukan konfigurasi PPP -> PPTP SERVER. (Point To Point Tunneling Protocol).

Kedua : Kita buat New Interface PPTP Server. Gak perlu setting macam-macam, langsung aja Klik OK.

Ketiga : Kita membuat IP Pool, atau sekelompok IP Address yang akan kita buat untuk mengalokasikan sejumlah IP Address untuk VPN Client per-user yang nanti akan terkoneksi ke Mikrotik VPN Server kita. Selain mengunakan IP Pool, kita juga bisa memberikan IP Address per-user satu per satu. Tapi jika jumlah VPN Client-nya banyak maka cara inilah yang tepat untuk kita lakukan. Caranya : Klik menu IP – POOL.

Keempat : Dari menu IP - Pool, selanjutnya buat New IP Pool. Misalnya kita alokasikan IP Address :192.168.88.10 – 192.168.88.20 dan kita berikan nama vpn-client.

Kelima : Selanjutnya kita lihat IP Pool yang kita buat telah berhasil dengan baik.

Keenam : Selanjutnya kita buat sebuah Profile dengan nama VPS-VPN (atau terserah suka-suka anda). Local Address adalah IP Address yang digunakan sebagai VPN Gateway oleh Mikrotik. Remote Address adalah IP Address yang akan diberikan kepada masing-masing VPN Client dan IP Address inilah yang dikenali dan berkomunikasi dengan PC yang lain.

Ketujuh : Selanjutnya kita klik PPTP SERVER. Option inilah yang menentukan Fitur PPTP SERVER berfungsi apa tidak pada Mikrotik kita. Aktifkan / centang tanda checkmark “ENABLE” lalu pilih Default Profile yang telah kita buat pada langkah keenam.

Kedelapan : Langkah selanjutnya adalah membuat User VPN di menu tab “SECRETS”. Setting Username, Password, Service : PPTP dan Profile VPS-VPN seperti gambar dibawah ini :

Kesembilan : Sampai disini tugas membangun VPN Server telah selesai dibuat dan langkah selanjutnya adalah membuat setting VPN Client di PC atau Laptop kita.

sumber : http://alifaljabar.blogspot.com/2010/05/vpn-virtual-private-network.html

Setting net2net VPN di IPCop

2010-08-18T08:22:00.003+07:00

Kali ini berkesempatan untuk menghubungkan 2 site yang sama2 mengunakan IPCOP versi 1.4.21 ( dengan IPsec VPN nya dan yang dipakai adalah paket openswan).

Jaringan yang ada sebagai berikut

gren1 -- site1 ---- internet ----- site2 --- green2

green1 adalah 192.168.1.0/24

site1 dengan IP Public 201.130.2.3 dengan hostname site1.localdomain

green2 adalah 192.168.2.0/24

site2 dengan IP Public 201.130.132.5 dengan hostname site2.localdomain

langkah2nya

1. Global Setting

Di site1

isi "Public IP or FQDN for RED interface or <%defaultroute>:" dengan 201.130.2.3, check "enabled" dan tekan Save

Di site2

isi "Public IP or FQDN for RED interface or <%defaultroute>:" dengan 201.130.132.5, check "enabled" dan
tekan Save

2. Generate Root/Host Certificates

di site1 : Tekan tombol "Generate Root/Host Certificates" dan isikan berikut dibawah

- Organization name : site1
- IPCops Hostname : site1.localdomain
- country : indonesia
- Tekan tombol "Generate Root/Host Certificates" dan tunggu beberapa saat
- dowload root certificate dan ganti namanya ke cacert.site1.pem
- download host certificate dan ganti namanya ke hostcert.site1.pem

di site2 : Tekan tombol "Generate Root/Host Certificates" dan isikan berikut dibawah

- Organization name : site2
- IPCops Hostname : site2.localdomain
- country : indonesia
- Tekan tombol "Generate Root/Host Certificates" dan tunggu beberapa saat
- dowload root certificate dan ganti namanya ke cacert.site2.pem
- download host certificate dan ganti namanya ke hostcert.site2.pem

3. Upload CA certificates
di site1

- CA Name : site2
- Browse dan pilih file "cacert.site2.pem
- Tekan tombol "Upload CA Certificate" dan ini akan menambahkan CA certificate dari site2 ke site1 dan akan nampak di baris ke 3 di certificate authorities.

di site2

- CA Name : site1
- Browse dan pilih file "cacert.site1.pem"
- Tekan tombol "Upload CA Certificate" dan ini akan menambahkan CA
certificate dari site1 ke site2 dan akan nampak di baris ke 3 di certificate authorities.

4. Membuat Koneksi
di site1 : Tekan tombol "ADD" dan pilih "net-to-net" Virtual Private Network" untuk conection type dan isikan dibawah ini

- Name : site2
- Host IP address : Red (201.130.2.3)
- local subnet : 192.168.1.0/255.255.255.0
- Remote Host/IP : 201.130.132.5
- Remote subnet : 192.168.2.0/ 255.255.255.0
- di "Authentication" section pilih "Upload a Certificate dan browse
file "hostcert.site2.pem"
- terakhir tekan tombol "Save"

di site2 : Tekan tombol "ADD" dan pilih "net-to-net" Virtual Private Network" untuk conection type dan isikan dibawah ini

- Name : site1
- Host IP address : Red (201.130.132.5)
- local subnet : 192.168.21.0/255.255.255.0
- Remote Host/IP : 201.130.2.3
- Remote subnet : 192.168.12.0/ 255.255.255.0
- di "Authentication" section pilih "Upload a Certificate dan browse file "hostcert.site1.pem"
- terakhir tekan tombol "Save"

5. selesai dan biarkan beberapa saat maka koneksi nya akan
berubah "Open'

Sumber : http://kafemis.blogspot.com/2009/06/net2net-vpn-di-ipcop.html

Cara Daftar ID Di Nusa Reborn

2009-06-01T16:41:00.001+07:00

Hasil Copast

wah sepertinya kawan2 kita sekarang kalo mau daftar id baru di nusareborn harus dengan sedikit lebih susah di karena hobi leaver menyebabkan pembatasa daftar id dengan sistem kirim email di sertai biodata negh cara daftar di nusa reborn . . .

Cara Membuat ID NusaReborn PvPGN Server:

Pembuatan ID NusaReborn mulai 28 February 2009 yang bertepatan dengan 1 tahun NusaReborn PvPGN Server. Telah kami persulit dimana pelanggaran² user semakin meningkat dikarenakan pembuatan ID yang sangat mudah, Sehingga user tidak menghargai ID yang mereka gunakan.

Berikut Langkah² Pendaftaran ID Battlenet NusaReborn:

1. Kirimkan Email Kepada: g_e_n_t_h_o_n_x@nusa.net.id
2. Subject: Pendaftaran ID Battlenet NusaReborn
3. Lampirkan scan-an kartu identitas anda melalui Attachement
4. Tuliskan Message sebagai berikut:

# IP Address anda: ? (Lihat IP Address Anda Disini)
# Username: ? (Max.character 15, character yang diperbolehkan: A-Z 0-9 _ ~ ^ [ ] { } = - +)
# Password: ? (Max.character 12)

Dengan ini saya secara sadar dan tidak ada tekanan dari pihak manapun. Bersedia menaati & mengikuti semua RULE yang ada di NusaReborn dan siap menerima sanksi bila melakukan Pelanggaran.

negh gambar contoh cara mengirimnya (klik untuk memperjelasnya)
"Perhatikan yang di beri tanda Merah"

Perlu di perhatikan untuk si pendaftar:
1. Proses pembuatan ID Max 10 hari, terhitung dari Tanggal Pengiriman
2. Tidak perlu mengirimkan berulang² cukup mengirimkan satu kali saja
3. Kartu identitas yang anda lampirkan harus dalam masa berlaku dan asli
4. Bila dianggap tidak memenuhi syarat maka Tidak Akan Di Proses + Tanpa Pemberitahuan

INGAT SATU KTP SATU ID . . .! ! !

UNTUK LEBIH DETAILNY ANDA MASUK KE FORUM NUSAREBORN

FORUM.NUSA.NET.ID

thankz regard . . .

source: NusaReborn Forum

Tutorial Mikrotik Pemula

2009-03-29T17:11:00.003+07:00

Tutorial ini di kutip dari Forum Mikrotik yang dibuat oleh kucingGarong

# SETUP MIKROTIK (base 1)
1. setelah mikrotik terinstall dengan baik dan benar jalankan mikrotik anda
2. masukkan username & password, dalam hal ini karena masih baru maka default usernam : admin pasword : blank
3. ganti nama ethernet anda jika anda mau, dalam hal ini anda dapat memberikan nama apa saja = [kucing@mikrotik] >interface
[kucing@mikrotik] interface >print (melihat dulu berapa banyak ethernet yg terpasang)
[kucing@mikrotik] interface >set 0 name=LAN
[kucing@mikrotik] interface >set 1 name=WAN
4. kemudian nambahkan ip addressnya
[kucing@mikrotik] >ip address
[kucing@mikrotik] ip address >add address=192.168.0.1/255.255.0.0 interface=LAN ----> ini untuk ip interface lokal
[kucing@mikrotik] ip address >add address=203.90.1.1/255.255.255.240 interface=WAN ---> ini untuk ip global yg di dapet dari ISP
5. kemudian masukin gatewaynya
[kucing@mikrotik] > ip route
[kucing@mikrotik] ip route >add gateway=xxx.xxx.xxx.xxx/xxx.xxx.xxx.xxx ----> ini merupakan gateway untuk keluar
6. kemudian setup webproxy
[kucing@mikrotik] >ip web-proxy
[kucing@mikrotik] ip web-proxy >set enable=yes
[kucing@mikrotik] ip web-proxy >set transparent-proxy=yes
[kucing@mikrotik] ip web-proxy >set max-object-size=1200KiB ---> ini supaya nge loadnya ngacir si web proxy
7. kemudian tambahkan rule supaya si client yg menggunakan port 80 akan di oper ke web-proxy
[kucing@mikrotik] >ip firewall nat
[kucing@mikrotik] ip firewall nat >add chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=3128
8. kemudian masukan dns nya
[kucing@mikrotik] >ip dns
[kucing@mikrotik] ip dns >set primary-dns=xxx.xxx.xxx.xxx
[kucing@mikrotik] ip dns >set secondary-dns=xxx.xxx.xxx.xxx
9. Sekarang masqurade interface WANnya
[kucing@mikrotik]>ip firewall nat
[kucing@mikrotik] ip firewall nat>add chain=srcnat out-interface=WAN action=masquerade
10. sekarang coba ping ke gateway & dns dari mikrotik, kalo REPLY berarti dah konek
11. heuehuueeuhehehueuheuh selesai juga dah tutorial ke 2 gw

----TUTORIAL SETUP HOTSPOT----
1.[kucing@mikrotik]>ip hotspot
2.[kucing@mikrotik] ip hotspot>setup
hotspot interface:LAN
local address of network:xxx.xxx.xxx.xxx/xx -->ip dari inteface LAN
masqurade network:yes
address pool of network:xxx.xxx.xxx.xxx-xxx.xxx.xxx.xxx
select certificate:none
ip address of SMTP server:0.0.0.0
DNS server:
DNS name:
name of local hotspot user: admin ----> user untuk masuk ke halam hotspot
password for the user:
3. sekarang buka web browser, ketikan ip addressnya hotspot
4.masukan username yg telah di buat tadi
5.walah berhasil kan......

------TUTORIAL USER MANAGER WITH HOTSPOT-------

1. enable dulu use-radius di hotspot
[kucing@mikrotik]>ip hotspot profile
2. [kucing@mikrotik] ip hotspot profile>print
3. akan terlihat profile2 yg telah di buat, kemudian tentukan profile mana yg akan di pake di use-radius
[kucing@mikrotik]ip hotspot profile> set 0 use-radius=yes
0 = merupakan nomor profile
4.sekarang bikin radiusnya
[kucing@mikrotik]>radius
[kucing@mikrotik]radius>add address=127.0.0.1
[kucing@mikrotik]radius>print
[kucing@mikrotik]radius>set 0 service=hotspot, login secret=12345678
5.sekarang bikin owner untuk di usermanager
[kucing@mikrotik]>/ tool user-manager customer add login="test" password="test" permissions=owner
6.sekarang bikin penghubung/supaya si mikrotik ngeroute ke usermanager
[kucing@mikrotik]>/ tool user-manager router add subscriber=MikroTik ip-address=127.0.0.1 shared-secret=12345678
7.nah setelah ini smua dah di buat, sekarang untuk ngetes apakah usermanager dah konek apa blom
8.buka web browser ketik " 127.0.0.1/userman "
9.akan tampil halaman login userman, masukin dah tuh username=test password=test
10.huehueuhehuuehehuehuheu.....akhirnya kelar juga tutorial usermanagernya

------TUTORIAL 2 ISP IN 1 ROUTER WITH LOADBALANCING------
/ ip address
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local comment="" \
disabled=no
add address=10.111.0.2/24 network=10.111.0.0 broadcast=10.111.0.255 interface=wlan2 \
comment="" disabled=no
add address=10.112.0.2/24 network=10.112.0.0 broadcast=10.112.0.255 interface=wlan1 \
comment="" disabled=no
/ ip firewall mangle
add chain=prerouting in-interface=Local connection-state=new nth=1,1,0 \
action=mark-connection new-connection-mark=odd passthrough=yes comment="" \
disabled=no
add chain=prerouting in-interface=Local connection-mark=odd action=mark-routing \
new-routing-mark=odd passthrough=no comment="" disabled=no
add chain=prerouting in-interface=Local connection-state=new nth=1,1,1 \
action=mark-connection new-connection-mark=even passthrough=yes comment="" \
disabled=no
add chain=prerouting in-interface=Local connection-mark=even action=mark-routing \
new-routing-mark=even passthrough=no comment="" disabled=no
/ ip firewall nat
add chain=srcnat connection-mark=odd action=src-nat to-addresses=10.111.0.2 \
to-ports=0-65535 comment="" disabled=no
add chain=srcnat connection-mark=even action=src-nat to-addresses=10.112.0.2 \
to-ports=0-65535 comment="" disabled=no
/ ip route
add dst-address=0.0.0.0/0 gateway=10.111.0.1 scope=255 target-scope=10 routing-mark=odd \
comment="" disabled=no
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10 routing-mark=even \
comment="" disabled=no
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10 comment="" \
disabled=no

Mangle

/ ip address
add address=192.168.0.1/24 network=192.168.0.0 broadcast=192.168.0.255 interface=Local comment="" \
disabled=no
add address=10.111.0.2/24 network=10.111.0.0 broadcast=10.111.0.255 interface=wlan2 \
comment="" disabled=no
add address=10.112.0.2/24 network=10.112.0.0 broadcast=10.112.0.255 interface=wlan1 \
comment="" disabled=no

router punya 2 upstream (WAN) interfaces dengan ip address 10.111.0.2/24 and 10.112.0.2/24. dan interface LAN dengan nama interface "Local" dan ip address 192.168.0.1/24.

/ ip firewall mangle

add chain=prerouting in-interface=Local connection-state=new nth=1,1,0 \
action=mark-connection new-connection-mark=odd passthrough=yes comment="" \
disabled=no

add chain=prerouting in-interface=Local connection-mark=odd action=mark-routing \
new-routing-mark=odd passthrough=no comment="" disabled=no

add chain=prerouting in-interface=Local connection-state=new nth=1,1,1 \
action=mark-connection new-connection-mark=even passthrough=yes comment="" \
disabled=no
add chain=prerouting in-interface=Local connection-mark=even action=mark-routing \
new-routing-mark=even passthrough=no comment="" disabled=no

NAT

/ ip firewall nat
add chain=srcnat connection-mark=odd action=src-nat to-addresses=10.111.0.2 \
to-ports=0-65535 comment="" disabled=no
add chain=srcnat connection-mark=even action=src-nat to-addresses=10.112.0.2 \
to-ports=0-65535 comment="" disabled=no

Routing

/ ip route
add dst-address=0.0.0.0/0 gateway=10.111.0.1 scope=255 target-scope=10 routing-mark=odd \
comment="" disabled=no
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10 routing-mark=even \
comment="" disabled=no
add dst-address=0.0.0.0/0 gateway=10.112.0.1 scope=255 target-scope=10 comment="" \
disabled=no comment="gateway for the router itself"

# SETUP QUEUE
mungkin banyak tersebar dimana2 bagaimana cara untuk membatasi BW, tapi kali ini saya mau mencoba memberikan tutorial yg sudah saya uji terlebih dahulu selama 40 jam 30 menit 100 detik dan berfungsi 100% dengan sempurna

oke kita mulai saja=

1. kita bikin/setup mangle dulu =
[Kucing@mikrotik] > ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 UP LOAD
chain=prerouting in-interface=LAN
src-address=xxx.xxx.xxx.xxx/xx action=mark-packet
new-packet-mark=test-up passthrough=no

1 MARK-KONEKSI
chain=forward src-address=xxx.xxx.xxx.xxx/xx
action=mark-connection
new-connection-mark=test-conn passthrough=yes

2 ;;; DOWN DIRECT KONEKSI
chain=forward in-interface=WAN
connection-mark=test-conn action=mark-packet
new-packet-mark=test-down passthrough=no

3 ;;; DOWN VIA PROXY
chain=output out-interface=LAN
dst-address=xxx.xxx.xxx.xxx/xx action=mark-packet
new-packet-mark=test-down passthrough=no

2. Tahap terahkir adalah membuat queue tree=

[Kucing@mikrotik] > queue tree pr
Flags: X - disabled, I - invalid
0 name="download" parent=LAN packet-mark=test-down
limit-at=32000 queue=default priority=8
max-limit=32000 burst-limit=0
burst-threshold=0 burst-time=0s

1 name="UPLOAD" parent=global-in
packet-mark=test-up limit-at=32000
queue=default priority=8
max-limit=32000 burst-limit=0
burst-threshold=0 burst-time=0s

di sini saya menggunakan queue typenya adalah PCQ kenapa, karena PCQ bisa secara otomatis membagi trafik per client

TUTORIAL MISAHIN BW LOKAL DAN INTERNATIONAL

1. Bikin src-address list dengan nama nise

2. atau dengan copy-paste src-address yg di sediain oleh nise
http://www.datautama.net.id/harijant...utama-nice.php
copy-paste bisa di lakukan dari putty.exe

3. Bikin mangel / supaya tau itu koneksi & paket nya dateng dari lokal ato international
/ ip firewall mangle
- add chain=forward src-address-list=nice action=mark-connection \
new-connection-mark=con-indonesia passthrough=yes comment=”mark all \
indonesia source connection traffic” disabled=no ----> untuk lokal

- add chain=forward dst-address-list=nice action=mark-connection \
new-connection-mark=con-indonesia passthrough=yes comment=”mark all \
indonesia destination connection traffic” disabled=no ----> untuk lokal

- add chain=forward src-address-list=!nice action=mark-connection \
new-connection-mark=con-overseas passthrough=yes comment=”mark all \
overseas source connection traffic” disabled=no ---> Untuk International

- add chain=forward dst-address-list=!nice action=mark-connection \
new-connection-mark=con-overseas passthrough=yes comment=”mark all \
overseas destination connection traffic” disabled=no

- add chain=prerouting connection-mark=con-indonesia action=mark-packet \
new-packet-mark=indonesia passthrough=yes comment=”mark all indonesia \
traffic” disabled=no ---> paket lokal

- add chain=prerouting connection-mark=con-overseas action=mark-packet \
new-packet-mark=overseas passthrough=yes comment=”mark all overseas \
traffic” disabled=no ----> paket international

4. Bikin simple queue =
/ queue simple
- add name=”test-indonesia” target-addresses=xxx.xxx.xxx.xxx/xx \
dst-address=0.0.0.0/0 interface=all parent=none packet-marks=indonesia \
direction=both priority=8 queue=default/default limit-at=0/0 \
max-limit=256000/256000 total-queue=default disabled=no ---> 256 UPLOAD & DOWNLOAD (LOKAL)

- add name=”test-overseas” target-addresses=xxx.xxx.xxx.xxx/xx \
dst-address=0.0.0.0/0 interface=all parent=none packet-marks=overseas \
direction=both priority=8 queue=default/default limit-at=0/0 \
max-limit=128000/128000 total-queue=default disabled=no ----> 256 UPLOAD & DOWNLOAD (INTERNATIONAL)

5. Untuk mengetahui benar ato tidaknya silahkan mengunjungi
http://www.sijiwae.net/speedtest/ ---> liat di kolom kecepatan koneksi

TUTORIAL SETING IP-PROXY & CONTOH PENGGUNANNYA (BASIC)
1. Mulai dengan mengkonfigure ip-proxy
/ip proxy
enabled: yes
src-address: 0.0.0.0
port: 8080 ---> bisa menggunakan port selain 8080
parent-proxy: 0.0.0.0:0
parent-proxy-port : 3128 ---> kalo ada lebih dari satu proxy
cache-drive: system
cache-administrator: "TESTING"
max-disk-cache-size: none
max-ram-cache-size: none
cache-only-on-disk: no
maximal-client-connections: 1000
maximal-server-connections: 1000
max-object-size: 512KiB
max-fresh-time: 3d

2. Sekarang buat supaya proxynya jadi transparan
/ip firewall nat
chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080 --->letakan setelah masquarade

3. Pastiin supaya proxy ente2 ga ada yg pake
/ip firewall filter
chain=input in-interface=PUBLIC-INTERFACE src-address=0.0.0.0/0 protocol=tcp dst-port=8080 action=drop

4. Contoh untuk memblok suatu site
/ip proxy access
dst-host=www.google.com action=deny
bisa juga memblok per ip, dengan memasukan src-address

5. Contoh untuk memblok/memberhentikan suatu jenis file
/ip proxy access
path=*.exe action=deny
path=*.mp3 action=deny
path=*.zip action=deny
path=*.rar action=deny.

6. Contoh lain
/ip proxy access
dst-host=:sex action=deny ---> akan memblok semua site yg ada kata SEX

Secure SMTP Server with Kerio MailSever

2009-03-27T11:00:00.009+07:00

Kerio MailServer provides a protection system that enables users to define who will be allowed to send email via this server and where. Anyone can connect to the SMTP server to send messages to local domains. However, only authorized users will be allowed to send email to other domains.

Antispam protection of the mailserver enables users to define who will be allowed to use this server and what actions he/she can perform. If the SMTP server is available from the Internet, any client can connect and use the server to send an email message. The server can be misused to send spam messages. Recipients of such email messages will see your SMTP server as the sender in the source text and might block receiving messages sent from this server.

The Parameters can be also set:

Relay Control Tab

Use the Relay control tab to set groups of allowed IP addresses and/or user authentication against SMTP server.

Allow relay only for
Use this option to activate user authentication by IP addresses or usernames and passwords (see below). Generally, authenticated users can use email messages to any domain via this server, whereas unauthorized users can send messages only to local domains.

Users from IP address group
Use this option to define a group of IP addresses from which email can be sent to any domain. Use the IP address group menu to choose an item from the list of groups defined in Configuration Definition IP Address Groups. Use the Edit button to edit a selected group or to create a new one (see chapter IP Address Groups).

Users authenticated through SMTP server for outgoing mail
Users authenticated through SMTP server using a valid username and password will be allowed to send email to any domain. Thus, all users that have their own accounts in Kerio MailServer will have this right.

Users authenticated through POP3 from the same IP address
Users authenticated through POP3 (username and password) will be granted relay access from their IP address for a given period of time. The default time period is 30 minutes.

Authentication by IP addresses is independent from authentication by usernames, therefore users must meet at least one of these conditions.

Open relay
In this mode, the SMTP server does not check users who use it to send email. Thus any user can send email messages to any domain. Warning:We recommend you not to use this mode if Kerio MailServer is available from the Internet. If you use this option, your server can be used for sending spam and it might be added to a blacklist of spam SMTP server database (see below).

Blacklists Tab

Kerio MailServer can also block incoming messages from servers that are considered as spam servers. For this purpose, it uses public databases of these servers located in the Internet or its own database (either an IP address group, or a list of servers in the Internet blacklists table).

To define these parameters go to the Blacklists tab in Configuration SMTP Server.

Kerio MailServer administrator can use a couple of different databases. These databases are independent and they can be used simultaneously. Users can also add databases in the Denied servers dialog box. This dialog is opened after you click Add.

ORDB Open Relay Database

This service is free. For details, go to ordb.org

Open Relay Database
Database of SMTP servers that are not protected from spam misuse.

Logs about received email messages can be created for individual groups (the Log option) or messages can be rejected (the Block option). If the Log option is active, information is recorded into the Security log. The analysis of this log can be used to acquire a list of IP addresses of servers from which spam have been sent.

Custom IP address spammers database
This option can be used to select a custom defined IP address group. Use the Edit button to edit the selection or to create a new group.

Security Options Tab

Apart from completely blocking certain senders Kerio MailServer provides options that limit, for example, sending too many messages or opening too many connections (known as DoS attack). These options can be set in the Security Options section.

Max. number of messages per hour…
Maximum count of messages that can be sent from one IP address per hour. This protects the disc memory from overload by too many messages (often identical and undesirable).

Max. number of concurrent SMTP connections…
Maximum number of concurrent TCP connections to the SMTP server from one IP address. This is a method of protection against DoS attacks (Denial of Service too many concurrent connections overload the system and no other users can connect to the server).

Max. number of unknown recipients …
Also known as a Directory harvest attack, this condition is met when an application that guesses common usernames of recipients’ fails up to the number of allowed unknown recipients.

Do not apply these limits to IP address group
Group of IP addresses on which the limitations will not be applied. This rule is often used for groups of local users (see the Relay Control tab). These users send all their outgoing mail through Kerio MailServer the count of messages sent by these users to this server is therefore much higher than the number of messages sent by external users (servers) that use it only to deliver mail to local domains.

Block if sender’s mail domain…
When a message is received Kerio MailServer checks whether the sender’s domain has a record in DNS. If not, the message will be rejected. This feature protects from senders with fictional email addresses. Note: This function may slow down Kerio MailServer (responses of DNS servers may take up to several seconds).

Max. number of recipients in a message
Maximum number of message recipients that will be accepted (in the Rcpt To: entry of the SMTP envelope). This will protect your server from possible loops between two or among more SMTP servers.

Max. number of failed commands…
Spam is often sent by special applications that connect to SMTP servers and ignore its error reports. If this option is enabled, Kerio MailServer will close the SMTP connection automatically after the defened number of failed commands has been expired.

Limit maximum incoming SMTP message size to
Maximum size of a message that will be accepted by the SMTP server. This protects the server from being overloaded by large messages. The 0 value means that no limitation is set. For easy definition you can switch between kilobytes (KB) and megabytes (MB).

Maximum number of accepted Received headers (hops)
This parameter helps the server block messages that have been trapped in a loop.

SMTP Delivery

In this section, the delivery parameters can be also set:

Deliver directly using DNS MX records
Mail will be delivered directly to destination domains using MX records.

Use relay SMTP server
All outgoing mail will be sent via another relay SMTP server.

Relay server hostname
DNS name or IP address of relay SMTP server.

Relay server port
Port where the relay SMTP is running. Typically the standard port 25 is used (this value is also set as Default).

Relay server requires authentication
Use this option if relay server requires authentication of sender (Kerio MailServer) using username and password. Specify the User and Password entries.

Authentication
Method of authentication at the relay server: SMTP AUTH Command or POP3 before SMTP (users enter local POP3 mailbox first they will be authenticated and allowed to send mail via SMTP server. Username and password used here will be used to login to the mailbox and no messages can be read. Therefore you do not need to define mailbox in Configuration POP3 Download to send an email message.)

Use SSL if supported by remote SMTP server…
When sending a message, SMTP server attempts to use encrypted connection first (SSL). If SSL connection is not supported, unencrypted connection will be used. Thus the maximal possible security of sent mail is ensured.

Queue Options

In this tab, mail queue can be set. It can be viewed in Status Mail Queue.

Maximum number of delivery threads
Maximum number of delivery threads that will send messages from the queue (maximum count of messages sent at one moment). The value should be chosen with respect to processor capacity and to speed of the Internet connection.

Delivery retry interval
Interval that will be used for repeated retry attempts for sending an email message.

Return the message to sender…
If the message cannot be delivered by expiration of this interval, it will be returned to sender. It will be automatically removed from the queue and no more delivery attempts will be taken by the server.

You can also use preset time units (minutes, hours, days) to specify the interval.

However, these time units will not be considered if the messages are delivered via relay SMTP server.

Send warning to sender…
If the message could not be delivered by expiration of this period, sender will be sent a warning (server will continue in sending attempts).

Report language
Language that will be used for error, warning and informative reports. Note:Reports are stored in the reports subdirectory of the directory where Kerio MailServer is installed (UTF-8 coding is used). Administrator can modify individual reports or add a new language report version.

Note: Just to remember, for more information read : redline-software.com