Hi All, I enabled fail2ban to ban ip if failed login is more then 3 times. When i try this i see that my public ip of my phone is blocked. [upl-image-preview url=https://community.mailcow.email/assets/files/2022-04-14/1649973007-406758-image.png] However i can still login in sogo. it does not block me? any advise on this. kind regards, Chris

Take a look weather your firewall outside your docker is working probably. Eg. `sudo nft list ruleset`. If you make changes or restarts it might have an individual startup sequence. So for example first restart nft, then fail2ban then docker for example. So try to restart your docker system.

@"KillVirus"#p5774 is this not arranged inside docker? fail2ban and the firewall?? do i need to install it on the host outside the docker?

@"Ckruijntjens"#p5775 @"KillVirus"#1337 In the log i see Banning 109.36.156.125/32 for 30 minutes however everything keeps working for this ip adres. if i run your command in cli sudo nft list ruleset i dont see the blocked ip adres..... how to troubleshoot this???

hmmm i receve this when rebooting.... Creating network "mailcowdockerized_mailcow-network" with driver "bridge" ERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule: (iptables failed: iptables --wait -t nat -I DOCKER -i br-mailcow -j RETURN: iptables: No chain/target/match by that name. (exit status 1))

hmmm error is gone after doing this docker-compose down systemctl stop docker iptables -F systemctl start docker docker-compose up -d however bans are not working..........

could it be the problem that i run mailcow behind an nginx reverse proxy server??? allredeay checked that and all public ip adresses are recorded correctly. where to go from here?

these are the ip adresses in kvm and docker. [upl-image-preview url=https://community.mailcow.email/assets/files/2022-04-25/1650912292-842030-image.png] all client ip adresses are logged correctly. logs showing ips are banned but i still can connect with this ip adres to all services??

@"KillVirus"#1337 i tried everything but it seems that its yust not working in my setup..... this is the output of nft list ruleset `root@mail:/opt/mailcow-dockerized# sudo nft list ruleset table ip nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; oifname != "br-mailcow" ip saddr 172.22.1.0/24 counter packets 74 bytes 5222 masquerade oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade oifname != "br-01f569c9d095" ip saddr 172.18.0.0/16 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.249 ip daddr 172.22.1.249 tcp dport 6379 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.3 ip daddr 172.22.1.3 tcp dport 8983 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.9 ip daddr 172.22.1.9 tcp dport 3306 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.11 ip daddr 172.22.1.11 tcp dport 443 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.11 ip daddr 172.22.1.11 tcp dport 80 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 12345 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 4190 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 995 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 993 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 143 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 110 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.253 ip daddr 172.22.1.253 tcp dport 587 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.253 ip daddr 172.22.1.253 tcp dport 465 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.253 ip daddr 172.22.1.253 tcp dport 25 counter packets 0 bytes 0 masquerade } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; fib daddr type local counter packets 247 bytes 14868 jump DOCKER } chain OUTPUT { type nat hook output priority -100; policy accept; ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER } chain DOCKER { iifname "br-mailcow" counter packets 0 bytes 0 return iifname "docker0" counter packets 0 bytes 0 return iifname "br-01f569c9d095" counter packets 0 bytes 0 return iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 7654 counter packets 0 bytes 0 dnat to 172.22.1.249:6379 iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 18983 counter packets 0 bytes 0 dnat to 172.22.1.3:8983 iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 13306 counter packets 0 bytes 0 dnat to 172.22.1.9:3306 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 443 counter packets 227 bytes 13620 dnat to 172.22.1.11:443 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 80 counter packets 0 bytes 0 dnat to 172.22.1.11:80 iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 19991 counter packets 0 bytes 0 dnat to 172.22.1.250:12345 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 4190 counter packets 0 bytes 0 dnat to 172.22.1.250:4190 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 995 counter packets 0 bytes 0 dnat to 172.22.1.250:995 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 993 counter packets 0 bytes 0 dnat to 172.22.1.250:993 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 143 counter packets 0 bytes 0 dnat to 172.22.1.250:143 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 110 counter packets 0 bytes 0 dnat to 172.22.1.250:110 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 587 counter packets 0 bytes 0 dnat to 172.22.1.253:587 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 465 counter packets 0 bytes 0 dnat to 172.22.1.253:465 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 25 counter packets 0 bytes 0 dnat to 172.22.1.253:25 } } table ip filter { chain DOCKER { iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.249 tcp dport 6379 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.3 tcp dport 8983 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.9 tcp dport 3306 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.11 tcp dport 443 counter packets 227 bytes 13620 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.11 tcp dport 80 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 12345 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 4190 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 995 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 993 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 143 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 110 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.253 tcp dport 587 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.253 tcp dport 465 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.253 tcp dport 25 counter packets 0 bytes 0 accept } chain DOCKER-ISOLATION-STAGE-1 { iifname "br-mailcow" oifname != "br-mailcow" counter packets 4705 bytes 17341525 jump DOCKER-ISOLATION-STAGE-2 iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 iifname "br-01f569c9d095" oifname != "br-01f569c9d095" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 counter packets 63132 bytes 302175167 return } chain FORWARD { type filter hook forward priority filter; policy drop; counter packets 63132 bytes 302175167 jump DOCKER-USER counter packets 63132 bytes 302175167 jump DOCKER-ISOLATION-STAGE-1 oifname "br-mailcow" ct state related,established counter packets 56180 bytes 284691934 accept oifname "br-mailcow" counter packets 2247 bytes 141708 jump DOCKER iifname "br-mailcow" oifname != "br-mailcow" counter packets 4705 bytes 17341525 accept iifname "br-mailcow" oifname "br-mailcow" counter packets 2013 bytes 127716 accept oifname "docker0" ct state related,established counter packets 0 bytes 0 accept oifname "docker0" counter packets 0 bytes 0 jump DOCKER iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept oifname "br-01f569c9d095" ct state related,established counter packets 0 bytes 0 accept oifname "br-01f569c9d095" counter packets 0 bytes 0 jump DOCKER iifname "br-01f569c9d095" oifname != "br-01f569c9d095" counter packets 0 bytes 0 accept iifname "br-01f569c9d095" oifname "br-01f569c9d095" counter packets 0 bytes 0 accept } chain DOCKER-USER { counter packets 119263 bytes 571386023 return } chain DOCKER-ISOLATION-STAGE-2 { oifname "br-mailcow" counter packets 0 bytes 0 drop oifname "docker0" counter packets 0 bytes 0 drop oifname "br-01f569c9d095" counter packets 0 bytes 0 drop counter packets 4705 bytes 17341525 return } } table ip6 nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; oifname != "docker0" ip6 saddr fd00:dead:beef:c0::/80 counter packets 0 bytes 0 masquerade } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; fib daddr type local counter packets 0 bytes 0 jump DOCKER } chain OUTPUT { type nat hook output priority -100; policy accept; ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER } chain DOCKER { iifname "docker0" counter packets 0 bytes 0 return } } table ip6 filter { chain DOCKER { } chain DOCKER-ISOLATION-STAGE-1 { iifname "br-mailcow" oifname != "br-mailcow" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 iifname "br-01f569c9d095" oifname != "br-01f569c9d095" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 counter packets 0 bytes 0 return } chain FORWARD { type filter hook forward priority filter; policy drop; counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1 oifname "docker0" ct state related,established counter packets 0 bytes 0 accept oifname "docker0" counter packets 0 bytes 0 jump DOCKER iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept } chain DOCKER-ISOLATION-STAGE-2 { oifname "br-mailcow" counter packets 0 bytes 0 drop oifname "docker0" counter packets 0 bytes 0 drop oifname "br-01f569c9d095" counter packets 0 bytes 0 drop counter packets 0 bytes 0 return } } `

> @"Ckruijntjens"#p5780 could it be the problem that i run mailcow behind an nginx reverse proxy server??? don't think so, mailcow might only see the ip from the host system so all access should be banned. But that's not the problem you have. > @"Ckruijntjens"#p5775 is this not arranged inside docker? fail2ban and the firewall?? It is inside the container. But I think docker in general needs the access to the firewall on the host system. > @"Ckruijntjens"#p5776 i dont see the blocked ip adres….. how to troubleshoot this??? that's ok the baned ip for sogo is within the container. Here it doesn't shown in the ruleset either but the IP is banned anyway for all services on the host. > @"Ckruijntjens"#p5777 ERROR: Failed to Setup IP tables: For me it seems that your ruleset might be the problem. I can't see any "chain INPUT" I guess it should be default. You might want to continue your search in that way: https://stackoverflow.com/questions/53766558/iptables-no-chain-target-match-error-with-docker-network-create

Fail2ban mailcow not working

KillVirus

KillVirus You might want to purge iptables
Ckruijntjens do i need both? iptables and nftables
[ ] I read what you wrote.

For me it works to purge (remove) iptable and working only with nftable. You will find some instructions to setup a firewall on your system in the web.

Ckruijntjens

KillVirus hmmm if i remove iptable docker wont start anymore….

Ckruijntjens

KillVirus what os are you using?

KillVirus

lol my system is working 😉 debian
Do you have nftable installed?
https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes

Ckruijntjens

KillVirus

yes it is installed.

Ckruijntjens

KillVirus i cant remove iptables. docker.io will also be removed…..

KillVirus

watch log files or error messages when start of docker fails.

Ckruijntjens

KillVirus its because docker.io is uninstalled.

when i reinstall docker.io iptables is installed by default.

Ckruijntjens

my setup is now.

host.
geust kvm debain 11. In this geust i installed docker. and docker (mailcow)

i dont understand why it is not working out of the box…

KillVirus

Ckruijntjens i dont understand why it is not working out of the box…
😅

On debian 10 it began switching:
https://wiki.debian.org/iptables#Current_status

I had problems with that mixture on debian 10 too. For me it works for removing all to do with iptable like I wrote.
On the link above you can also see how it should look like in standard with: “Chain INPUT”
And again you might want to find a good guide to setup your firewall.

Ckruijntjens

something else is going on or wrong however i can not find it. maybe i will install a empty vm i reinstall all to se if it works.

verry strange…………

Ckruijntjens

@KillVirus

what debian version are you using?

Ckruijntjens

KillVirus when i dont run anythin else on this machine i do not have to create a manual firewall rules correct?

Ckruijntjens

KillVirus when you remove all iptables packages. how did you reinstall docker then?

because it will uninstall docker on my system?

KillVirus

please look for a “how to set up nftable firewall on debian”.. Or read my link above for learning in 10min 😉

KillVirus

I did the firewall things before installing docker. So I can’t help.
But when you read the debian link above you see, that iptable is on deb11 some kind of layer and nftable is still working as backend. So removing might not the right way for you. Try to stop docker and flush rules and configure as a plain new firewall. Keep care not to lock out when playing 😉

Ckruijntjens

KillVirus even when i install a new vm

and install nftables and then install docker docker is installing iptables………..

KillVirus

duplicated with:
https://community.mailcow.email/d/1326-autobanning-of-ip-address-via-netfilter

Ckruijntjens

i yust installed a vm debian 11.
installed nftables
i installed docker and mailcow basic install.
created a test user and checked if the user is getting blocker.
same issue…… so on a bare metal installation it is not working.

maybe the team of mailcow has to look in to this?

Ckruijntjens

@pkernstock

Could you test if the ip is actually banned? Because in my setup netfilter shows me in mailcow ui that the IP is blocked.

But with the same op I can open webmail etc etc.

« Previous Page Next Page »