I've responded to you twice and my messages aren't getting posted for some reason.     I'll try again.     I'm seeing a consistent trickle of failed authentication attempts on our Exchange server.  It's nothing major, around 20 / hour, but after the HAFNIUM attacks last March, I'm trying to be more proactive about blocking these IP addresses.      We're got a 1:1 NAT allowing TCP ports 25, 443 & 587 to our exchange server. We've also got a 1:1 NAT allowing TCP 443 & UDP 500/4500 to our VPN server.     I tried your ping test from our exchange server and despite having rules denying traffic to 141.98.11.0/24, Lithuania & explicitly blocking 141.98.11.13, the ping is still successful.    We're on version MX 17.6, if that makes a difference.       Edit: We have 5 MX Appliances.  2 with 1:1 NAT and 3 with no NAT forwarding rules.  The only appliance that the Layer 7 firewall rules do not work as expected is the one I originally posted about.   ... View more

We're seeing a consistent trickle of failed authentication attempts on our Exchange server.  It's nothing major, around 20 / hour, but since the HAFNIUM attacks last march, I'm trying to be more proactive about monitoring and blocking unwanted access attempts.    We've got a 1:1 NAT to our Exchange server allowing TCP ports 25, 443 & 587.  We've also got a 1:1 NAT to our VPN server allowing TCP 443 & UDP 500/4500.    I'm pretty sure the Deny countries rule has blocked email from countries listed in the past.  Does it only block outgoing traffic?  The rule language says To/From, so I assumed it blocked incoming traffic as well as outgoing.    Thanks again for your help,   Ian   ... View more

We're seeing a continuous trickle of authentication attempts on our Exchange server.  It's nothing major, about 20 attempts / hour, but since the HAFNIUM attacks last March, I'm trying to monitor and be more proactive against potential threats.   We have a 1:1 NAT to our exchange server allowing TCP ports 25, 443 & 587.   Additionally, we have a 1:1 NAT to a VPN server allowing TCP 443 & UDP 500/4500.    Soon after I enabled the Deny countries rule about a year ago, it prevented us from receiving email from the countries listed, but perhaps it also only blocks outbound traffic even though the rule uses the terminology "To/From"?     Thanks again for you help.    Ian    ... View more

Thanks.  Is there a way to block incoming IPv4 traffic?   Any idea why the Deny countries rule isn't blocking traffic from Lithuania?      ... View more