> -----Original Message-----
> From: Nigel Metheringham
> [mailto:Nigel.Metheringham@dev.intechnology.co.uk]
> Sent: 28 June 2006 15:25
> To: Gareth Hastings
> Cc: exim-users@???
> Subject: Re: [exim] Another system filter question!
>
> On Wed, 2006-06-28 at 15:09 +0100, Gareth Hastings wrote:
> > Hi,
> >
> > I have this in my system filters
> >
> > if $message_headers matches
> >
"(207.126.144|207.126.145|207.126.146|207.126.147|207.126.148|207.126.14
> >
9|207.126.150|207.126.151|207.126.152|207.126.153|207.126.154|207.126.14
> > 7)"
> > then
> >
> > and was wondering if I can put the "(207.126......" section into a
text
> > file?
>
> You really don't want to do this - its doing nothing like what you
> think!
>
> You do realise that a message with subject
> Subject: Phone me on 01207 1263144
> would match....
Oops, I didn't even think about that one!!
>
> [Remember . is a wildcard in regular expressions]
>
> Even if you fixed that, you would still find that both 207.126.144.32
> and 127.207.126.144 would both match...
>
> Its also pretty bad practice to do spam filtering in a system filter
> because you cannot reject at that stage - you either make mail
disappear
> silently, or you have to generate a bounce (which since it will be
aimed
> at an innocent third party who has their sender address forged, puts
you
> in the position of the villan).
I was using this rule to basically copy email that didn't come from the
above IP addresses to a different mailbox.
>
> I suggest you do this in a content ACL.
>
> And if you want to match an ip address using a regexp try something
> closer to
> 207\.126\.1(?:4[4-9]|5[0-4])\.\d+
> ideally with something else round it - like escaped [] to make the
match
> stronger.
>
> Nigel.
>
Thanks for the reply
Gareth
