Spamhause Blacklist & Port 25 traffic

mrpfsense

Recently, over the last three weeks were have been placed on the spamhause blacklist. Spamhause is suggesting port 25 is leaking traffic.

If spamhause is correct:

how do i monitor or trace what traffic (specifically on port 25) is leaving the pfsense server?
how do i configure pfsense to only allow traffic on port 25 from one server?

Thanks for your help.

SteveITS

@mrpfsense
(don't do this but)
1 ) on LAN add a firewall rule that passes port 25 outbound to any and logs it.

instead do:
2a) on LAN allow port 25 outbound from the one server IP, and
2b) second rule after 2a: on LAN block port 25 outbound and log it

If spam is being sent that implies a PC is infected. Alternately Spamhaus has other lists like the policy list were the ISP reports it shouldn't be sending mail at all...often set for DHCP IPs.