hi I don't know if it's coincidence, but since this morning, after carrying out update 2024-04, the link to see the list of banned IPs no longer works, see the images, thank you for your help. Debian 12 Mailcow 2024-04 with docker [upl-image-preview url=https://community.mailcow.email/assets/files/2024-04-04/1712230538-101969-1.png] [upl-image-preview url=https://community.mailcow.email/assets/files/2024-04-04/1712230547-534619-2.png] sorry for the post, I solved the problem by manually renewing the certificates LE everything was back to normal, because I had an error, see image [upl-image-preview url=https://community.mailcow.email/assets/files/2024-04-04/1712231605-981484-3.png]

I moved the banlist from json_api.php to f2b-banlist.php https://github.com/mailcow/mailcow-dockerized/commit/c2848b810b56017a24f2c828f3aa2e7cfe3ab434 I will merge this tomorrow. The new endpoint will be something like `https://mailcow.tld/f2b-banlist?id=`

> @"FreddleSpl0it"#p14597 mailcow/mailcow-dockerizedc2848b8 I applied your changes and it works again, Thank you very much [upl-image-preview url=https://community.mailcow.email/assets/files/2024-04-05/1712298594-185340-1.png]

The link to see the list of banned IPs no longer works

Cisco30

hi
I don’t know if it’s coincidence, but since this morning, after carrying out update 2024-04, the link to see the list of banned IPs no longer works, see the images, thank you for your help.
Debian 12
Mailcow 2024-04 with docker

sorry for the post, I solved the problem by manually renewing the certificates LE everything was back to normal, because I had an error, see image

DocFraggle

I guess this was intended, see this PR:

mailcow/mailcow-dockerized5818/files#diff-21202528ebaff17a92fca6b6a561e38cd41fe83f8c3356f7425f4b94104bf1b4

I think you have to ask @FreddleSpl0it about it

FreddleSpl0it

The PR introduced this bug, but it was not intended for this endpoint in that manner. I had to secure the json_api because SOGo would directly make HTTP GET requests to relative URLs if they were embedded in an HTML email. The problem is that your browser automatically sends a Sec-Fetch-Dest: document header. If the header is present, the call will be blocked.
I will try to fix this.

FreddleSpl0it

I moved the banlist from json_api.php to f2b-banlist.php
mailcow/mailcow-dockerizedc2848b8

I will merge this tomorrow. The new endpoint will be something like https://mailcow.tld/f2b-banlist?id=<BANLIST-ID>

Cisco30

FreddleSpl0it mailcow/mailcow-dockerizedc2848b8

I applied your changes and it works again, Thank you very much

Cisco30

@FreddleSpl0it
I’m sorry, but I said error in my previous post, it doesn’t work even after renewing the LE certificates.
but I see that you have taken care of the problem, thank you

NB:it works with the machine’s IP…

maybl8

How do I get to this link . I would like to see it on my machine.
Thanks

maddler

In the Fail2Ban page.

maybl8

OK found it at the bottom of the page.
Question:
If I have a set of ip addresses being dropped by ip tables. My understanding is they are blocked then from even getting to mailcow server.
If I put a list in fail2ban blacklist the attacker as I am calling him or her will still be able to attack my mailcow server but be blocked from doing anything?
Hope my question is clear enough.

maddler

iptables will prevent any connection coming from the blocked IPs, so it will prevent from using any application running on your server.
This does not mean that a well motivated attacker can’t do anything.
(Over)simplified things on purpose.

maybl8

OK that is what I thought.
So here is what I am doing and I know this is a never ending job adding these and most people would find it unnecessary but it is what I am choosing to do.
Do you know how big this list can get before it causes any issues with mailcow?
I have read about ip sets and see if that will make it easier to maintain this list.

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       0    --  *      *       1.28.0.0/16          0.0.0.0/0
    0     0 DROP       0    --  *      *       1.235.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       3.75.0.0/16          0.0.0.0/0
    0     0 DROP       0    --  *      *       13.38.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       14.162.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       20.210.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       24.97.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       31.173.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       36.32.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       39.46.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       41.207.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       41.214.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       58.58.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       58.225.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       59.9.0.0/16          0.0.0.0/0
    0     0 DROP       0    --  *      *       60.16.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       61.51.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       61.134.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       78.153.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       81.94.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       82.223.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       84.238.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       87.120.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       91.138.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       91.215.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       91.218.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       94.65.0.0/16         0.0.0.0/0
    0     0 DROP       0    --  *      *       103.149.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       103.186.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       109.107.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       112.27.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       112.194.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       113.160.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       118.26.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       121.12.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       121.22.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       122.224.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       123.115.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       123.209.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       124.221.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       125.19.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       125.71.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       125.72.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       136.158.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       139.162.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       141.98.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       141.101.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       144.48.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       162.158.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       164.52.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       165.227.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       166.180.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       172.58.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       172.68.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       175.120.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       175.139.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       176.194.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       181.67.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       182.76.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       184.105.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       185.142.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       185.147.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       185.149.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       185.165.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       185.241.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       188.255.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       189.56.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       192.52.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       192.210.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       194.164.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       195.97.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       195.239.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       197.255.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       198.235.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       200.35.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       200.232.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       205.210.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       207.90.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       208.105.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       211.178.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       218.22.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       218.39.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       219.76.0.0/16        0.0.0.0/0
    0     0 DROP       0    --  *      *       221.130.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       221.226.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       222.185.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       180.232.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       183.108.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       129.205.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       195.218.0.0/16       0.0.0.0/0
    0     0 DROP       0    --  *      *       222.235.0.0/16       0.0.0.0/0
   71  9098 RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0

maddler

that depends on a number of factors:

specs of the server
traffic on your server
size of your userbase
how many connection your server

That’s something you might test by adding a randum number of random IPs and see how that goes.

In general I’d tend to agree that’s unnecessary/extra work you’re doing tho’.
You might want consider using a different subnet size as part of your F2B configuration (perhaps a /28 or a /27) and a longer ban and maximum ban time, rather than getting yourself into a rabbit hole.

Another option you might want to consider is to use GEOIP module to block traffic coming from certain countries. That would massively reduce the number of rules your firewall will need to go thru at every connection.

domi-btnr

For some odd reason, the F2B Page still shows the old Link. When I try to use the new Link, then i get a 404. WIth the Link from the F2B Page, I get Error 403. I updated and restarted mailcow 5 Minutes ago. The only thing that works for me rn is using the machines local ip together with the old link

Cisco30

to apply the fix, or you wait for the next Mailcow update or you modify these 4 files:
data/web/admin.php
data/web/f2b-banlist.php
data/web/json_api.php
data/web/templates/admin/tab-config-f2b.twig

mailcow/mailcow-dockerizedc2848b8