Hi All, I enabled fail2ban to ban ip if failed login is more then 3 times. When i try this i see that my public ip of my phone is blocked. [upl-image-preview url=https://community.mailcow.email/assets/files/2022-04-14/1649973007-406758-image.png] However i can still login in sogo. it does not block me? any advise on this. kind regards, Chris

Take a look weather your firewall outside your docker is working probably. Eg. `sudo nft list ruleset`. If you make changes or restarts it might have an individual startup sequence. So for example first restart nft, then fail2ban then docker for example. So try to restart your docker system.

@"KillVirus"#p5774 is this not arranged inside docker? fail2ban and the firewall?? do i need to install it on the host outside the docker?

@"Ckruijntjens"#p5775 @"KillVirus"#1337 In the log i see Banning 109.36.156.125/32 for 30 minutes however everything keeps working for this ip adres. if i run your command in cli sudo nft list ruleset i dont see the blocked ip adres..... how to troubleshoot this???

hmmm i receve this when rebooting.... Creating network "mailcowdockerized_mailcow-network" with driver "bridge" ERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule: (iptables failed: iptables --wait -t nat -I DOCKER -i br-mailcow -j RETURN: iptables: No chain/target/match by that name. (exit status 1))

hmmm error is gone after doing this docker-compose down systemctl stop docker iptables -F systemctl start docker docker-compose up -d however bans are not working..........

could it be the problem that i run mailcow behind an nginx reverse proxy server??? allredeay checked that and all public ip adresses are recorded correctly. where to go from here?

these are the ip adresses in kvm and docker. [upl-image-preview url=https://community.mailcow.email/assets/files/2022-04-25/1650912292-842030-image.png] all client ip adresses are logged correctly. logs showing ips are banned but i still can connect with this ip adres to all services??

@"KillVirus"#1337 i tried everything but it seems that its yust not working in my setup..... this is the output of nft list ruleset `root@mail:/opt/mailcow-dockerized# sudo nft list ruleset table ip nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; oifname != "br-mailcow" ip saddr 172.22.1.0/24 counter packets 74 bytes 5222 masquerade oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade oifname != "br-01f569c9d095" ip saddr 172.18.0.0/16 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.249 ip daddr 172.22.1.249 tcp dport 6379 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.3 ip daddr 172.22.1.3 tcp dport 8983 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.9 ip daddr 172.22.1.9 tcp dport 3306 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.11 ip daddr 172.22.1.11 tcp dport 443 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.11 ip daddr 172.22.1.11 tcp dport 80 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 12345 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 4190 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 995 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 993 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 143 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.250 ip daddr 172.22.1.250 tcp dport 110 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.253 ip daddr 172.22.1.253 tcp dport 587 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.253 ip daddr 172.22.1.253 tcp dport 465 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.22.1.253 ip daddr 172.22.1.253 tcp dport 25 counter packets 0 bytes 0 masquerade } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; fib daddr type local counter packets 247 bytes 14868 jump DOCKER } chain OUTPUT { type nat hook output priority -100; policy accept; ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER } chain DOCKER { iifname "br-mailcow" counter packets 0 bytes 0 return iifname "docker0" counter packets 0 bytes 0 return iifname "br-01f569c9d095" counter packets 0 bytes 0 return iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 7654 counter packets 0 bytes 0 dnat to 172.22.1.249:6379 iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 18983 counter packets 0 bytes 0 dnat to 172.22.1.3:8983 iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 13306 counter packets 0 bytes 0 dnat to 172.22.1.9:3306 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 443 counter packets 227 bytes 13620 dnat to 172.22.1.11:443 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 80 counter packets 0 bytes 0 dnat to 172.22.1.11:80 iifname != "br-mailcow" meta l4proto tcp ip daddr 127.0.0.1 tcp dport 19991 counter packets 0 bytes 0 dnat to 172.22.1.250:12345 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 4190 counter packets 0 bytes 0 dnat to 172.22.1.250:4190 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 995 counter packets 0 bytes 0 dnat to 172.22.1.250:995 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 993 counter packets 0 bytes 0 dnat to 172.22.1.250:993 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 143 counter packets 0 bytes 0 dnat to 172.22.1.250:143 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 110 counter packets 0 bytes 0 dnat to 172.22.1.250:110 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 587 counter packets 0 bytes 0 dnat to 172.22.1.253:587 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 465 counter packets 0 bytes 0 dnat to 172.22.1.253:465 iifname != "br-mailcow" meta l4proto tcp ip daddr 192.168.2.8 tcp dport 25 counter packets 0 bytes 0 dnat to 172.22.1.253:25 } } table ip filter { chain DOCKER { iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.249 tcp dport 6379 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.3 tcp dport 8983 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.9 tcp dport 3306 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.11 tcp dport 443 counter packets 227 bytes 13620 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.11 tcp dport 80 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 12345 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 4190 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 995 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 993 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 143 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.250 tcp dport 110 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.253 tcp dport 587 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.253 tcp dport 465 counter packets 0 bytes 0 accept iifname != "br-mailcow" oifname "br-mailcow" meta l4proto tcp ip daddr 172.22.1.253 tcp dport 25 counter packets 0 bytes 0 accept } chain DOCKER-ISOLATION-STAGE-1 { iifname "br-mailcow" oifname != "br-mailcow" counter packets 4705 bytes 17341525 jump DOCKER-ISOLATION-STAGE-2 iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 iifname "br-01f569c9d095" oifname != "br-01f569c9d095" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 counter packets 63132 bytes 302175167 return } chain FORWARD { type filter hook forward priority filter; policy drop; counter packets 63132 bytes 302175167 jump DOCKER-USER counter packets 63132 bytes 302175167 jump DOCKER-ISOLATION-STAGE-1 oifname "br-mailcow" ct state related,established counter packets 56180 bytes 284691934 accept oifname "br-mailcow" counter packets 2247 bytes 141708 jump DOCKER iifname "br-mailcow" oifname != "br-mailcow" counter packets 4705 bytes 17341525 accept iifname "br-mailcow" oifname "br-mailcow" counter packets 2013 bytes 127716 accept oifname "docker0" ct state related,established counter packets 0 bytes 0 accept oifname "docker0" counter packets 0 bytes 0 jump DOCKER iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept oifname "br-01f569c9d095" ct state related,established counter packets 0 bytes 0 accept oifname "br-01f569c9d095" counter packets 0 bytes 0 jump DOCKER iifname "br-01f569c9d095" oifname != "br-01f569c9d095" counter packets 0 bytes 0 accept iifname "br-01f569c9d095" oifname "br-01f569c9d095" counter packets 0 bytes 0 accept } chain DOCKER-USER { counter packets 119263 bytes 571386023 return } chain DOCKER-ISOLATION-STAGE-2 { oifname "br-mailcow" counter packets 0 bytes 0 drop oifname "docker0" counter packets 0 bytes 0 drop oifname "br-01f569c9d095" counter packets 0 bytes 0 drop counter packets 4705 bytes 17341525 return } } table ip6 nat { chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; oifname != "docker0" ip6 saddr fd00:dead:beef:c0::/80 counter packets 0 bytes 0 masquerade } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; fib daddr type local counter packets 0 bytes 0 jump DOCKER } chain OUTPUT { type nat hook output priority -100; policy accept; ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER } chain DOCKER { iifname "docker0" counter packets 0 bytes 0 return } } table ip6 filter { chain DOCKER { } chain DOCKER-ISOLATION-STAGE-1 { iifname "br-mailcow" oifname != "br-mailcow" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 iifname "br-01f569c9d095" oifname != "br-01f569c9d095" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 counter packets 0 bytes 0 return } chain FORWARD { type filter hook forward priority filter; policy drop; counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1 oifname "docker0" ct state related,established counter packets 0 bytes 0 accept oifname "docker0" counter packets 0 bytes 0 jump DOCKER iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept } chain DOCKER-ISOLATION-STAGE-2 { oifname "br-mailcow" counter packets 0 bytes 0 drop oifname "docker0" counter packets 0 bytes 0 drop oifname "br-01f569c9d095" counter packets 0 bytes 0 drop counter packets 0 bytes 0 return } } `

> @"Ckruijntjens"#p5780 could it be the problem that i run mailcow behind an nginx reverse proxy server??? don't think so, mailcow might only see the ip from the host system so all access should be banned. But that's not the problem you have. > @"Ckruijntjens"#p5775 is this not arranged inside docker? fail2ban and the firewall?? It is inside the container. But I think docker in general needs the access to the firewall on the host system. > @"Ckruijntjens"#p5776 i dont see the blocked ip adres….. how to troubleshoot this??? that's ok the baned ip for sogo is within the container. Here it doesn't shown in the ruleset either but the IP is banned anyway for all services on the host. > @"Ckruijntjens"#p5777 ERROR: Failed to Setup IP tables: For me it seems that your ruleset might be the problem. I can't see any "chain INPUT" I guess it should be default. You might want to continue your search in that way: https://stackoverflow.com/questions/53766558/iptables-no-chain-target-match-error-with-docker-network-create

Fail2ban mailcow not working

Ckruijntjens

@pkernstock

Are the blocked ips actualy blocked in you setup? (So the ip can not connect to webmail etc)?

pkernstock

Sorry. I only find time helping out in my free-time, as I’m not working for mailcow.

But to answer your question: Yes, seems to work. (that’s not a manual ban)

Ckruijntjens

pkernstock

Hi,

Still have a question. how is your setup? is your mailcow server connected directly ot the internet with its own ip adres?

or….?

Ckruijntjens

ok.

and you configured your firewall manualy? or yust how it comes out of the box?

pkernstock

It’s just a plain, boring Ubuntu 20.04 installation with mailcow installed. Nothing extraordinary.

Ckruijntjens

pkernstock maybe there is a differnce with debian 12 and ubuntu?

Ckruijntjens

pkernstock

i really dont understand it. i just installed a vm(lxd) ubuntu system. even this one is not banning……………..

pkernstock

lxd? You mean LXC?

Are you performing the failing logins from a different subnet?

Ckruijntjens

pkernstock

Well docker is inside a other range then mailcow.

See picture. Is this a problem?

pkernstock

To start from the beginning:

Perform a invalid login with a wrong password to Postfix (directly, no webmail) in two ways:
1. From your client, as you’ve been testing so far
2. From an external client in the internet, outside your main network. Like your mobile phone in the public mobile network.
Check the postfix logs and search for the failed logins
Which IPs do you see being responsible for the failed logins? (Internal? Public IP?)

Ckruijntjens

pkernstock

If i send an email from

internal network. it uses an internal ip 172.22.1.248.
external network. it uses the public ip adres.

so if i do failed logins its the same.

so this is good i believe….

Ckruijntjens

pkernstock

and in netfilter container its also showing the public ip adres when i do failed login attmepts. It also show the right ip adres to be banned but its not blocking any connections from this ip adres

Ckruijntjens

@pkernstock

now i see the ban if i do iptables -L

Chain MAILCOW (2 references)
target prot opt source destination
REJECT all – 109.36.155.154 anywhere reject-with icmp-port-unreachable

so this is more then before. however i can still connect….. is there any service i need to enable on the host?

Ckruijntjens

plus i see some errors in the netfilter logs. dont know if more people have this issue?

netfilter-mailcow_1 | Clearing all bans
netfilter-mailcow_1 | Initializing mailcow netfilter chain
netfilter-mailcow_1 | Watching Redis channel F2B_CHANNEL
netfilter-mailcow_1 | Exception ignored in atexit callback: <function clear at 0×7f4758f4cf70>
netfilter-mailcow_1 | Traceback (most recent call last):
netfilter-mailcow_1 | File “/server.py”, line 282, in clear
netfilter-mailcow_1 | logInfo(‘Clearing all bans’)
netfilter-mailcow_1 | File “/server.py”, line 61, in logInfo
netfilter-mailcow_1 | log(‘info’, message)
netfilter-mailcow_1 | File “/server.py”, line 51, in log
netfilter-mailcow_1 | r.lpush(‘NETFILTER_LOG’, json.dumps(tolog, ensure_ascii=False))
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/commands/core.py”, line 2603, in lpush
netfilter-mailcow_1 | return self.execute_command(“LPUSH”, name, *values)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1235, in execute_command
netfilter-mailcow_1 | Exception in thread Thread-1 (watch):
netfilter-mailcow_1 | Traceback (most recent call last):
netfilter-mailcow_1 | File “/server.py”, line 319, in watch
netfilter-mailcow_1 | return conn.retry.call_with_retry(
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/retry.py”, line 49, in call_with_retry
netfilter-mailcow_1 | for item in pubsub.listen(): fail(error)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1239, in <lambda>
netfilter-mailcow_1 |
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1619, in listen
netfilter-mailcow_1 | lambda error: self._disconnect_raise(conn, error),
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1225, in disconnect_raise
netfilter-mailcow_1 | response = self.handle_message(self.parse_response(block=True)) raise error
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/retry.py”, line 46, in call_with_retry
netfilter-mailcow_1 |
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1497, in parse_response
netfilter-mailcow_1 | return do()
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1236, in <lambda>
netfilter-mailcow_1 | response = self.execute(conn, conn.read_response)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1479, in execute
netfilter-mailcow_1 | lambda: self.send_command_parse_response(
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1212, in send_command_parse_response
netfilter-mailcow_1 | return self.parse_response(conn, command_name, **options)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1251, in parse_response
netfilter-mailcow_1 | response = connection.read_response()
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/connection.py”, line 828, in read_response
netfilter-mailcow_1 | raise ConnectionError(f"Error while reading from {hosterr}“ f” : {e.args}")
netfilter-mailcow_1 | redis.exceptions.ConnectionError: Error while reading from 172.22.1.249:6379 : (104, ‘Connection reset by peer’)
netfilter-mailcow_1 | Error 113 connecting to 172.22.1.249:6379. Host is unreachable. - trying again in 3 seconds
netfilter-mailcow_1 | Clearing all bans
netfilter-mailcow_1 | Initializing mailcow netfilter chain
netfilter-mailcow_1 | Watching Redis channel F2B_CHANNEL
netfilter-mailcow_1 | Exception ignored in atexit callback: <function clear at 0×7fac317fd090>
netfilter-mailcow_1 | Traceback (most recent call last):
netfilter-mailcow_1 | File “/server.py”, line 282, in clear
netfilter-mailcow_1 | Exception in thread Thread-1 (watch):
netfilter-mailcow_1 | Traceback (most recent call last):
netfilter-mailcow_1 | File “/server.py”, line 319, in watch
netfilter-mailcow_1 | logInfo(‘Clearing all bans’)
netfilter-mailcow_1 | File “/server.py”, line 61, in logInfo
netfilter-mailcow_1 | log(‘info’, message)
netfilter-mailcow_1 | File “/server.py”, line 51, in log
netfilter-mailcow_1 | r.lpush(‘NETFILTER_LOG’, json.dumps(tolog, ensure_ascii=False))
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/commands/core.py”, line 2603, in lpush
netfilter-mailcow_1 | for item in pubsub.listen():
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1619, in listen
netfilter-mailcow_1 | return self.execute_command(“LPUSH”, name, values)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1235, in execute_command
netfilter-mailcow_1 | return conn.retry.call_with_retry(
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/retry.py”, line 49, in call_with_retry
netfilter-mailcow_1 | response = self.handle_message(self.parse_response(block=True))
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1497, in parse_response
netfilter-mailcow_1 | fail(error)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1239, in <lambda>
netfilter-mailcow_1 | response = self.execute(conn, conn.read_response)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1479, in execute
netfilter-mailcow_1 | lambda error: self.disconnect_raise(conn, error),
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1225, in disconnect_raise
netfilter-mailcow_1 | return conn.retry.call_with_retry(
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/retry.py”, line 49, in call_with_retry
netfilter-mailcow_1 | fail(error)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1481, in <lambda>
netfilter-mailcow_1 | raise error
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/retry.py”, line 46, in call_with_retry
netfilter-mailcow_1 | return do()lambda error: self.disconnect_raise_connect(conn, error),
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1468, in disconnect_raise_connect
netfilter-mailcow_1 |
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1236, in <lambda>
netfilter-mailcow_1 | raise error
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/retry.py”, line 46, in call_with_retry
netfilter-mailcow_1 | return do()
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1480, in <lambda>
netfilter-mailcow_1 | lambda: command(args, **kwargs),
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/connection.py”, line 822, in read_response
netfilter-mailcow_1 | response = self.parser.read_response(disable_decoding=disable_decoding)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/connection.py”, line 318, in read_response
netfilter-mailcow_1 | raw = self.buffer.readline()
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/connection.py”, line 249, in readline
netfilter-mailcow_1 | self.read_from_socket()
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/connection.py”, line 195, in read_from_socket
netfilter-mailcow_1 | raise ConnectionError(SERVER_CLOSED_CONNECTION_ERROR)
netfilter-mailcow_1 | redis.exceptions.ConnectionError: Connection closed by server.
netfilter-mailcow_1 |
netfilter-mailcow_1 | During handling of the above exception, another exception occurred:
netfilter-mailcow_1 |
netfilter-mailcow_1 | Traceback (most recent call last):
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/connection.py”, line 609, in connect
netfilter-mailcow_1 | lambda: self.send_command_parse_response(
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1212, in _send_command_parse_response
netfilter-mailcow_1 | return self.parse_response(conn, command_name, **options)
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/client.py”, line 1251, in parse_response
netfilter-mailcow_1 | response = connection.read_response()
netfilter-mailcow_1 | File “/usr/lib/python3.10/site-packages/redis/connection.py”, line 828, in read_response
netfilter-mailcow_1 | raise ConnectionError(f"Error while reading from {hosterr}“ f” : {e.args}")
netfilter-mailcow_1 | redis.exceptions.ConnectionError: Error while reading from 172.22.1.249:6379 : (104, ‘Connection reset by peer’)
netfilter-mailcow_1 | Redis is loading the dataset in memory - trying again in 3 seconds
netfilter-mailcow_1 | Clearing all bans
netfilter-mailcow_1 | Initializing mailcow netfilter chain
netfilter-mailcow_1 | Watching Redis channel F2B_CHANNEL
netfilter-mailcow_1 | 109.38.152.182 matched rule id 9 ([66]: SOGoRootPage Login from ‘109.38.152.182’ for user ‘ndnd’ might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0)
netfilter-mailcow_1 | 2 more attempts in the next 86400 seconds until 109.38.152.182/32 is banned
netfilter-mailcow_1 | 109.38.152.182 matched rule id 9 ([66]: SOGoRootPage Login from ‘109.38.152.182’ for user ‘ndnd’ might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0)
netfilter-mailcow_1 | 1 more attempts in the next 86400 seconds until 109.38.152.182/32 is banned
netfilter-mailcow_1 | 109.38.152.182 matched rule id 9 ([66]: SOGoRootPage Login from ‘109.38.152.182’ for user ‘ndnd’ might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0)
netfilter-mailcow_1 | Banning 109.38.152.182/32 for 1440 minutes
netfilter-mailcow_1 | 109.38.152.182 matched rule id 9 ([66]: SOGoRootPage Login from ‘109.38.152.182’ for user ‘ndnd’ might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0)
netfilter-mailcow_1 | Banning 109.38.152.182/32 for 1440 minutes
netfilter-mailcow_1 | 109.38.152.182 matched rule id 9 ([66]: SOGoRootPage Login from ‘109.38.152.182’ for user ‘ndnd’ might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0)
netfilter-mailcow_1 | Banning 109.38.152.182/32 for 1440 minutes
netfilter-mailcow_1 | 109.38.152.182 matched rule id 9 ([66]: SOGoRootPage Login from ‘109.38.152.182’ for user ‘ndnd’ might not have worked - password policy: 65535 grace: -1 expire: -1 bound: 0)
netfilter-mailcow_1 | Banning 109.38.152.182/32 for 1440 minutes
netfilter-mailcow_1 | 202.102.144.122 matched rule id 4 (warning: non-SMTP command from unknown[202.102.144.122]: GET _ HTTP_1.1)
netfilter-mailcow_1 | 2 more attempts in the next 86400 seconds until 202.102.144.122/32 is banned
netfilter-mailcow_1 | 170.130.187.10 matched rule id 4 (warning: non-SMTP command from unknown[170.130.187.10]: GET _ HTTP_1.1)
netfilter-mailcow_1 | 2 more attempts in the next 86400 seconds until 170.130.187.10/32 is banned

pkernstock

Ckruijntjens Still have a question. how is your setup? is your mailcow server connected directly ot the internet with its own ip adres?

Directly connected.

Ckruijntjens plus i see some errors in the netfilter logs. dont know if more people have this issue?

No, never seen similar issue on GitHub or the Telegram groups yet. But not working with mailcow professionally.

Ckruijntjens netfilter-mailcow_1 | redis.exceptions.ConnectionError: Error while reading from 172.22.1.249:6379 : (104, ‘Connection reset by peer’)

Looks like your redis is down/not reachable? If it is running, there’s indeed something weird network-wise or generally in your netstack.

Ckruijntjens How did you installed mailcow? did you installed a host and on top of this docker with mailcow?

A VM on top of VMware ESXi, with Ubuntu 18.04. Normal installation right from the docs. Nothing special.

Are you using the docker-ce version from docker directly as per the docs?

Ckruijntjens

@pkernstock

How did you installed mailcow? did you installed a host and on top of this docker with mailcow?

« Previous Page