Solved

Using Connection Filter in Office 365/Hosted Exchange in conjunction with AppRiver

Posted on 2014-02-28
3
810 Views
Last Modified: 2014-03-07
Hello experts.

We use hosted exchange in office 365 in conjunction with AppRiver for spam protection.  All incoming emails are supposed to go through appriver before being approved and then forwarded to office365/exchange.  

What has been occurring is that some spammers are sending directly to office365 thereby bypassing our spam protection altogether.  I looked at some recommendations from AppRiver and in theory all I need to do is add a list of their IP Addresses and Networks to the 'IP Allow List' under Exchange--Protection--Connection Filter, and then block everything else (if email is received from an IP on both lists, it will be allowed).  

"IP addresses must be specified in the format nnn.nnn.nnn.nnn where nnn is a number from 0 to 255. You can also specify Classless Inter-Domain Routing (CIDR) ranges in the format nnn.nnn.nnn.nnn/rr where rr is a number from 24 to 32. IPv6 address can be input but messages sent from these addresses will not be accepted by the service. "

Because of the CIDR Range limits listed above, I am unsure how to go about blocking large ranges of addresses, or if I am even aproaching this problem in the right way(I have only been working with Office365 for about 4 weeks).

Thanks in advance.
0
Comment
Question by:orther
  • 2
3 Comments
 
LVL 39

Accepted Solution

by:
Adam Brown earned 500 total points
ID: 39895937
What you need to do is modify your default Receive connector so that it will only accept email from App-River. Since you're on office 365, you can do this by going to Exchange->Mail Flow -> Connectors then you can create a new Receive connector. Click the + sign, then Fill out the wizard that pops up. Enter * for the Sender Domains then enter the IP Address range for App-River (should be able to get this from their website somewhere) under Sender IP Addresses. Give the connector a name and leave everything else default. This will make sure that the only IP addresses that are able to send to your tenant are from App-River, so you won't have to have a huge list of blocked IPs, just a list of allowed ones.
0
 

Author Comment

by:orther
ID: 39896023
"The Hybrid Mail Flow inbound connector was created when hybrid mail flow was configured.  This connector cannot be modified."

This is in the comment box of the only inbound connector I see currently.  Will that be a problem?
0
 
LVL 39

Expert Comment

by:Adam Brown
ID: 39896037
No. Just add another connector and set it up accordingly, but make sure your On-prem IPs are in Sender IPs as well.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Read this checklist to learn more about the 15 things you should never include in an email signature.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This lesson covers basic error handling code in Microsoft Excel using VBA. This is the first lesson in a 3-part series that uses code to loop through an Excel spreadsheet in VBA and then fix errors, taking advantage of error handling code. This l…
A company’s greatest vulnerability is their email. CEO fraud, ransomware and spear phishing attacks are the no1 threat to a company’s security. Cybercrime is responsible for the largest loss of money to companies today with losses projected to r…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question