Solved

Using Connection Filter in Office 365/Hosted Exchange in conjunction with AppRiver

Posted on 2014-02-28
3
751 Views
Last Modified: 2014-03-07
Hello experts.

We use hosted exchange in office 365 in conjunction with AppRiver for spam protection.  All incoming emails are supposed to go through appriver before being approved and then forwarded to office365/exchange.  

What has been occurring is that some spammers are sending directly to office365 thereby bypassing our spam protection altogether.  I looked at some recommendations from AppRiver and in theory all I need to do is add a list of their IP Addresses and Networks to the 'IP Allow List' under Exchange--Protection--Connection Filter, and then block everything else (if email is received from an IP on both lists, it will be allowed).  

"IP addresses must be specified in the format nnn.nnn.nnn.nnn where nnn is a number from 0 to 255. You can also specify Classless Inter-Domain Routing (CIDR) ranges in the format nnn.nnn.nnn.nnn/rr where rr is a number from 24 to 32. IPv6 address can be input but messages sent from these addresses will not be accepted by the service. "

Because of the CIDR Range limits listed above, I am unsure how to go about blocking large ranges of addresses, or if I am even aproaching this problem in the right way(I have only been working with Office365 for about 4 weeks).

Thanks in advance.
0
Comment
Question by:orther
  • 2
3 Comments
 
LVL 38

Accepted Solution

by:
Adam Brown earned 500 total points
ID: 39895937
What you need to do is modify your default Receive connector so that it will only accept email from App-River. Since you're on office 365, you can do this by going to Exchange->Mail Flow -> Connectors then you can create a new Receive connector. Click the + sign, then Fill out the wizard that pops up. Enter * for the Sender Domains then enter the IP Address range for App-River (should be able to get this from their website somewhere) under Sender IP Addresses. Give the connector a name and leave everything else default. This will make sure that the only IP addresses that are able to send to your tenant are from App-River, so you won't have to have a huge list of blocked IPs, just a list of allowed ones.
0
 

Author Comment

by:orther
ID: 39896023
"The Hybrid Mail Flow inbound connector was created when hybrid mail flow was configured.  This connector cannot be modified."

This is in the comment box of the only inbound connector I see currently.  Will that be a problem?
0
 
LVL 38

Expert Comment

by:Adam Brown
ID: 39896037
No. Just add another connector and set it up accordingly, but make sure your On-prem IPs are in Sender IPs as well.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Local Continuous Replication is a cost effective and quick way of backing up Exchange server data. The following article describes the steps required to configure Local Continuous Replication. Also, the article tells you how to restore from a backup…
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now