Autobanning of ip address via netfilter

Ckruijntjens

Hi All,

i installed mailcow behind a reverse proxy. everything is working except the autoban feature. if i login wrong a couple of times i see that the ip adres of my client is listed as blocked, however when i am going with the same client to the sogo webmail i can login with no problems at all.

Anyone got an idea what could be the problem?

Ckruijntjens

anyone that can help me?

Ckruijntjens

is there something whe need to install extra? before banning works?

wasabi

Ckruijntjens I´m not sure what is blocked by fail2ban - only the application TCP port or the whole client IP.
You could give it a try and find out if you get blocked also when trying to login to sogo multiple times with wrong creds…?

Ckruijntjens

wasabi hi,

Allredeay did the test. When my IP is blocked everything keeps working. Sogo webmail and active sync cliënt also. Seems nothing is blocked

wasabi

sogo webmail and activesync both go via http(s). Did you try SMTP/IMAP?

Edit: you could use telnet to check the ports 😇

Ckruijntjens

wasabi

Hi @wasabi i checked and its not banning anything…… it shows the public ip that is being banned, however with the same ip i can do everything. imap webmail etc etc

pkernstock

Bare-metal? What virtualization solution is being used on your host?
Have you iptables installed on your mailcow server?
Which OS are you using?
What is the error message netfilter is providing when IP is being banned?

Ckruijntjens

pkernstock

hi,

i am using a kvm virtual machine (debian bullseye) here in installed docker.
iptables is not installed on my mailcow server. (nftables is installed)
no error messages are given.

pkernstock

Then please install iptables and try again, just give it a try

Ckruijntjens

pkernstock

sorry i see that iptables is installed

Ckruijntjens

pkernstock

apt install iptables
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
iptables is already the newest version (1.8.7-1).

pkernstock

The netfilter python script uses iptc (python-iptables). Therefore the guess it’s related to iptables somehow.

Otherwise I can’t only imagine there’s something wrong with permissions or so? Anything specific set on your docker daemon? Any enhanced security settings or so? Is the netfilter container running privileged?

Any rules from mailcow-bans here?

iptables -L -vn:
iptables -L -vn -t nat:

Ckruijntjens

pkernstock

i did not changed anything after installing docker and pulling the containers… how can i check if the containers are running in privliged mode?

Ckruijntjens

pkernstock

this is the outpu from iptables. no public ips are banned.

`root@mail:/opt/mailcow-dockerized# iptables -L -vn

Warning: iptables-legacy tables present, use iptables-legacy to see them

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
41732 262M DOCKER-USER all – * * 0.0.0.0/0 0.0.0.0/0
41732 262M DOCKER-ISOLATION-STAGE-1 all – * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all – * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – docker0 docker0 0.0.0.0/0 0.0.0.0/0
38369 261M ACCEPT all – * br-mailcow 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
1673 105K DOCKER all – * br-mailcow 0.0.0.0/0 0.0.0.0/0
1690 190K ACCEPT all – br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
1631 103K ACCEPT all – br-mailcow br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – * br-01f569c9d095 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all – * br-01f569c9d095 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – br-01f569c9d095 !br-01f569c9d095 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all – br-01f569c9d095 br-01f569c9d095 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain DOCKER (3 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.3 tcp dpt:8983
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:12345
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:4190
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:995
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:993
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:143
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.250 tcp dpt:110
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.10 tcp dpt:3306
40 2400 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.11 tcp dpt:443
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.11 tcp dpt:80
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.249 tcp dpt:6379
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:587
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:465
0 0 ACCEPT tcp – !br-mailcow br-mailcow 0.0.0.0/0 172.22.1.253 tcp dpt:25

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all – docker0 !docker0 0.0.0.0/0 0.0.0.0/0
1690 190K DOCKER-ISOLATION-STAGE-2 all – br-mailcow !br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DOCKER-ISOLATION-STAGE-2 all – br-01f569c9d095 !br-01f569c9d095 0.0.0.0/0 0.0.0.0/0
41732 262M RETURN all – * * 0.0.0.0/0 0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
pkts bytes target prot opt in out source destination
0 0 DROP all – * docker0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all – * br-mailcow 0.0.0.0/0 0.0.0.0/0
0 0 DROP all – * br-01f569c9d095 0.0.0.0/0 0.0.0.0/0
1690 190K RETURN all – * * 0.0.0.0/0 0.0.0.0/0

Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
41732 262M RETURN all – * * 0.0.0.0/0 0.0.0.0/0
`

pkernstock

Just google’ed: https://stackoverflow.com/questions/32144575/how-to-know-if-a-docker-container-is-running-in-privileged-mode

Ckruijntjens

pkernstock

docker inspect –format=‘{{.HostConfig.Privileged}}’ 032c834a289f
true

this is the netfilter container

Ckruijntjens

i just can not seem to get it working??

@pkernstock

how can i troubleshoot this any further?

pkernstock

Sorry, I don’t have any further ideas here - and the info It works on my machine won’t help you either I think. I’m running Ubuntu 20.04 LTS here, and it works.

When an IP is banned, what does the netfilter docker container log exactly? Might want to post the log excerpt here? If netfilter logs it’s banning the IP, the software should be fine. So it must be something with docker itself or something iptables-ish.

pkernstock

Okay, reverting back: Haven’t tested the ban actually on my setup. However I’m closing this thread in favor of the newer, more current thread https://community.mailcow.email/d/1545-fail2ban-mailcow-not-working/31 you opened. Just to avoid confusion.