title: iptables - block (wildcard-)subdomains because of bruteforce with different IP's
body: <p>In my /var/log/mail.log of my ubuntu 14.04-server I find a huge amount of lines like these:</p>
  
  <pre><code>Sep 16 13:23:03 server postfix/smtpd[25621]: warning: 212-83-162-157.rev.poneytelecom.eu[212.83.162.157]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
  ....
  Sep 16 12:57:29 server postfix/smtpd[24828]: warning: 212-83-175-192.rev.poneytelecom.eu[212.83.175.192]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
  </code></pre>
  
  <p>So I think, someone criminal tries to log in at postfix to send spam. As you can see at every attempt the criminal uses a different IP and subdomain. So blocking by configuring iptables to block specific IP's makes no sense.
  So what I want to do is to block all subdomains of the domain "poneytelecom.eu" by iptables.</p>
  
  <p>Therefore I tried different things:</p>
  
  <pre><code>iptables -I INPUT -m string --algo bm --string "*poneytelecom.eu" -j DROP
  iptables -I INPUT -m string --string "Host: *poneytelecom.eu" --algo bm -j DROP
  iptables –A INPUT –m string --algo bm --string "*poneytelecom.eu" -j DROP
  </code></pre>
  
  <p>The command "iptables -L -n --line" says this:</p>
  
  <pre><code>Chain INPUT (policy ACCEPT)
  num  target     prot opt source               destination         
  1    DROP       all  --  0.0.0.0/0            0.0.0.0/0            STRING match  "Host: *poneytelecom.eu" ALGO name bm TO 65535
  2    DROP       all  --  0.0.0.0/0            0.0.0.0/0            STRING match  "*poneytelecom.eu" ALGO name bm TO 65535
  3    DROP       all  --  0.0.0.0/0            0.0.0.0/0            STRING match  "*poneytelecom.eu" ALGO name bm TO 65535
  </code></pre>
  
  <p>But with that it does not work; I still can see breakin-attempts in /var/log/mail.log by this domain:</p>
  
  <pre><code>Sep 16 13:32:25 server postfix/smtpd[25922]: warning: 62-210-188-107.rev.poneytelecom.eu[62.210.188.107]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
  </code></pre>
  
  <p>Does anybody know, what I'm doing wrong respectively how to block subdomains by iptables?</p>