Message Filter, remote-ip syntax

[Henk Fictorie - Ulrich]

Hi,

I wrote a message filter using a syntax like

if (remote-ip == "10.1.4.0/22") { drop(); }

However when a message is send from 10.1.4.1, it doesn't match with this filter. Is my syntax correct. Or should I use something like:

if (remote-ip == "10.1.4-7.") etc..

Henk Fictorie

[Ken Stieers]

The filters aren't smart enough to interpret the ip that way.  You'll have to write a regex to do it. Or just put the ip in the HAT in the BLOCKED sendergroup.

[Henk Fictorie - Ulrich]

Thanks, I will check this.

The manual refers to the "Sender Group Syntax", which includes the CIDR notation. In a somewhat cryptic sentence you could read that only "sequences and numeric ranges of IP addresses" are supported. You could interpret it as that CIDR is not supported.

[exMSW4319 · Accepted solution]

Ken's right. If you want to address a classless range then it has to be an entry in a HAT sender group unless it can be expressed in a REGEX, which can be messy and costly in CPU.

It's possible to have a filter (not a rule) that reacts to sender group name.

By contrast, only filters and rules can do partial matches of host names.

[Henk Fictorie - Ulrich]

I tried several things, but finally used HAT sender groups and that worked.