Feature Request: Improved Fail2Ban IP List Management

zeronemo I need to emphasize that I’m not trying to check SSH or log files. I’m using the mailcow web interface precisely because it provides a convenient way to view and interact with banned IPs

Yes, as of now what you want is not possible in the WebUI, as you have already noticed yourself, and that is why other members of the forum have shared how to achieve similar things in other ways.

The majority of users in this forum are not developers, so if you have ideas for features that would improve the UI or other aspects of Mailcow, it might be better to open a feature request on GitHub: mailcow/mailcow-dockerizedissues

However, I would also like to say that it probably makes little sense to put a lot of effort into things like manual filtering and searching of ban lists directly in Mailcow, but if anything, maybe add more fine-grained control over how fail2ban handles bans, although most of this is already there, and just increasing the bantime to e.g. a week will already significantly reduce the noise.

What would make more sense, imho, would be to add a UI to add and manage external blocklists.

Reasoning:

1. Nobody has the time to manually check and block IPs and manually maintain blocklists. This is a Sisyphean task as the attacks come in waves and the IP addresses / IP ranges are constantly changing. This is something you want to outsource and automate as much as possible, unless you have the time and inclination to spend all day manually checking and blocking IPs.

2. For log management and alerts there are already external solutions like Greylog, Grafana Loki etc. that will always do a better job than what Mailcow will ever be able to offer, which of course doesn’t mean that they shouldn’t continue to improve the UI or add things that make sense and can be done with reasonable effort.

I feel this thread now need little bit of opposition for future readers. Every one should consider if it’s a good idea to set-up Mailcow netfilter to ban /16 for one year.

Let’s take @maybl8 (s) first hits, yes first 3 bans are for EU/US based most likely fine, but last one can be problematic if you are EU based. Let’s examine IP allocation by state
₁₅% spain (₁₀ 000 IPs)
₁₀% switzerland (₆ 500 IPs)
₇% germany (₄ 600 IPs)

Yes, this range also contains allocation to more problematic states like Russia, Ukraine, Uzbekistan, Malaysia, Singapore, Syria, Iran and so

Now let’s look for same by ASNs
₄% AS39572 (₂ 500 IPs) DataWeb Global Group B.V. seems like Netherlands privet hosting services.
₂% AS16086 (₁ 300 IPs), DNA Finland seems like Finland ISP
₂% AS25375 (₁ 300 IPs), Leucom Stafag / Leucom Schlatter AG seems like Switzerland ISP
₂% AS39878 (₁ 300 IPs) PR-Link Internet seems like Austria ISP

Yes you enforce ban for let’s say some Middle east bot-net and maybe by right, but you also ban multiple services that does not do any wrong, in first ASN case even possible legit mail servers in paid hosting. And next three could be your users home ISP,…

So once again everyone should consider if 1 year ban for /16 is a good solution for him/her.

maybl8
What you are suggestion is quiet lot of work, like whitelisting IP if know,.. and problem is when you ban /16 how you know what to whitelist and even so it’s often after problem occur, after ban has been applied and this false-positive ban in /16 make problem,… This is not suitable for me.

Do not know how MC netfilter hold up under pressure, but in classic fail2ban I got about 15k targeted bans (ipv4/32), for mail server it is not big problem,…

If you realy need to, you can make own firewall on host (in front of MC) and for example utilize maxmid geoip database to filter for example china, also it should not be hard to make new “backlist” in rspamd for country like in multimap.conf COUNTRY_BL {
type = "country";
map = "${LOCAL_CONFDIR}/local.d/country_bl.map";
score = 12;
description = "List of countries with heavy spam usage";
} it will be much less work to always revert it before update, make update and make it again in stead of looking for what have been ban every day,…

Edit: example for geoip and iptables

Gist

Easily install and configure GeoIP for use with iptables which enables you to block/allow entire countries.

Easily install and configure GeoIP for use with iptables which enables you to block/allow entire countries. - README.md

So I changed some settings. I have the following now:

Blacklisted networks/hosts:
165.154.240.111

See a list of banned IPs below: network (remaining ban time) - [actions].
IPs queued to be unbanned will be removed from the active ban list within a few seconds.
Red labels indicate active permanent bans by blacklisting.

https://mail.dccathome.com/f2b-banlist?id=9a48875e-1f0b-4f87-bb44-593f3411c82e
 12.189.234.28/32 (8735h 02m 17s) - [unban] [whitelist] [blacklist (needs restart)]

 148.222.132.39/32 (8745h 45m 33s) - [unban] [whitelist] [blacklist (needs restart)]

 203.252.10.4/32 (8757h 31m 13s) - [unban] [whitelist] [blacklist (needs restart)]

 1.30.20.98/32 (8757h 31m 49s) - [unban] [whitelist] [blacklist (needs restart)]

 165.154.240.111

That last ip address shows up in red in the bottom of the list.
What does that mean?
Also if I blacklist an ip should I use 165.154.240.111/32 instead of just the single IP.

As part of this change I also removed my dropped ip’s from the iptables DOCKER-USER since I am doing this now.

One of the things I want to do is reduce the postfix traffic from happening. Seems like a lot of noise when someone hits the spamhaus filters. These guys keep trying over and over for a while.
I know it’s ok and they eventually stop but it bother’s me.
Thanks