Rules with IP addresses

[Caza Henha]

Hi,
 
I have recently installed Mailscanner with Postfix and MailWatch and it seems over the last week the system is running great, however I am now getting requests to tweak the default rules that I have from various users in different departments. I have been trying to delve into the knitty gritty of the rules and understand the principles and they do not seem very complicated and when looking at some examples on the Wiki things shouldn't be to difficult.
 
Consequently I have noticed a number of examples have IP addresses in the From section of the rules and I was just wondering where this IP address was coming from and what it can actually be as I cannot seem to find any documentation on it. For example is this IP address (or the RegEx of one) the connecting smtp server (or any smtp server that the mail has passed through), client address, MX address of the sending domain etc or any combination of all the previous?
 
Also can this be used in a "To" configuration, the reason I ask is that essentially we have four internal smtp servers which does sound like we process a lot of mail but they are basically queues for our application servers. Due to the current "trial" policy all spam is being marked and delivered and sorted at the client software, however we have a trouble ticket application that is currently getting lots of spam and because it sends out confirmation receipts etc we are getting bounces that are filling the queues. Although easy, I don't necessarily wish to have loads of "To" rules with the individual addresses of the trouble ticket system so I was wondering whether I could have the IP address (or even better the FQDN) of the forwarding SMTP server in the To rule, something like the following:
 
spam.rules
 
To:     ticketing.example.com    delete    // Ticketing SMTP server
To:     exchange.example.com   store     // Exchange server
FromOrTo:  default                  deliver
 
Is the above possible? If not is the following,
 
 
To:     192.168.15.1    delete    // Ticketing SMTP server
To:     192.168.15.2   store      // Exchange server
FromOrTo:  default                  deliver
 
Kind Regards,
 
Caza
 
_________________________________________________________________
Win New York holidays with Kellogg’s & Live Search 
http://clk.atdmt.com/UKM/go/107571440/direct/01/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080901/9b36dd17/attachment.html