My company's IP address is now black listed by CBL and Spamhaus

I checked and realized some fool on our network had an infected computer. How would a hardware firewall prevent these spamming viruses? Or there is no such thing?

 

It depends.

The simple answer is yes and no.

A firewall will "hide" your internal network from external queries -- so the script kiddies who scan IP blocks won't find any vulnerable machines. This is of course supposing you set up the firewall correctly and don't do anything stupid.

On the other hand, your machines can still become infected if a stupid user executes something bad, aka a trojan.

The best approach is to tier your protection. Start with a firewall, a Cisco Pix 515 etc (or even a cheapy Linksys SOHO 80 dollar job), and add some manner of virus scanning to your inbound email system. If you use sendmail or qmail there are a lot of nice free options out there, if you use Exchange you can buy a few decent packages.

Follow up with a virus scanner on each computer within your network to stop anyone from bringing stuff in from the outside on memory sticks, CD's, Zips etc.

I get scanned on average 4 times an hour -- and recently watched as a fresh 2003 server machine was up for less than 4 hours outside of the firewall before being owned.

If you want help or more detail hit me up via PM, I will be glad to talk you through what I would do in your shoes.

 

From what I know about spamhouse, a firewall will not help you any.

Spamhouse blacklists IP addresses and that means that is your mail server that is blacklisted.

The only way I know is to have your mail server do header matching (matches the from bit to an internal emal address) on outgoing email. This will stop the spam a lot as most of the spamming viruses use random email addresses on the from address.

 

Very easily. You just block outgoin port 25 from all client machines. The only machine that needs to send outgoing email is your mail server. If the infected hosts are blocked at the firewall they won't be able to spam.

 

This is exactly what we do for all our clients. Only allow outbound port 25 traffic on the mail server and set up alerts to notify if it detects port 25 traffic on any other machine.