EFW Support

Getting a steady flood of ransomware laden zip attachments, anyone have a clue how I can block these?

Anyone?

Hi,

Please try this: Proxy -> SMTP -> Configuration -> File settings -> enable "Block files by extensions" -> enable "Block archives that contain blocked filetypes" -> choose extension(s) -> Save

Being under the SMTP section i assumed this was related to outgoing email.

Hi dda,

No, it's working in both ways.

I'm using these settings everyday.

"The purpose of the SMTP proxy is to control and optimise the SMTP traffic and to protect the local networks from threats when using the SMTP protocol. SMTP is used whenever an e-mail is sent from a local e-mail client to a remote mail server, that is, for the outgoing e-mails. It will also be used if an mail server is running on the LAN (i.e., within the GREEN zone) or DMZ (ORANGE zone) and the e-mails can be sent from outside the local network (incoming requests) through t hat mail server, that is, when clients are allowed to send e-mails from the RED interface."

http://docs.endian.com/3.2/utm/proxy/smtp.html

I don't have a mail server behind the firewall will this still work for me?

Hi dda,

I really don't know! I never tried this scenario. My email server is in DMZ.
But you can try. It's very easy to try. Is that server your email server, even if isn't behind your firewall?
Presuming yes, you send and receive emails also from a desktop client (Thunderbird, Outlook, ...) not only from web mail. Maybe will work.

Yes I am using outlook as a client and the emails are still passing thru.  I have had two machines recently with ransomware infections that came inside zip files so I am trying to prevent it happening again.