Can someone tell me why I don't see the blocked IPs? The logfile says the blocking is happening, even after multiple restarts. Regards, Z [upl-image-preview uuid=07b65749-2bbe-4c1f-9b93-4e75d4aaa67a url=https://community.mailcow.email/assets/files/2025-03-17/1742240285-533331-1.jpg alt={TEXT?}]

fail2ban

zeronemo

Can someone tell me why I don’t see the blocked IPs? The logfile says the blocking is happening, even after multiple restarts.

Regards, Z

DocFraggle

zeronemo The logfile says the blocking is happening

Which logfile are you referring to?

zeronemo the release notes for 2025-02 had a to-do regarding Fail2ban. Did you do that?

@D4niel is right, did you do what was mentioned here

Important Fix: Dovecot & Netfilter
Previously, Dovecot allowed multiple failed login attempts within a single session without being properly detected by Netfilter. This has now been fixed.

📌 Action required: Admins should reset Fail2ban Regex filters:
System → Configuration → Options → Fail2Ban Parameters → Expand Regex Filters → Click “Reset to Default”

DocFraggle

zeronemo but it’s still not showing the banned IPs

Which banned IPs are you referring to exactly? You were talking about a logfile, no idea what you were talking about

zeronemo The logfile says the blocking is happening

D4niel

I’m not sure if this is related, but the release notes for 2025-02 had a to-do regarding Fail2ban. Did you do that?

zeronemo

I reset the fail2ban regexes and restarted netfilter, but it’s still not showing the banned IPs. What could be the problem? Where can I check the log files to see what the issue might be, or do I need to configure fail2ban within Docker?

Regards, Z

zeronemo

I have about 23,000 IPs added to iptables, but they are not displayed on the web interface in blue as they used to be. I don’t even know if they are being blocked at all, or if there are so many IPs that they are no longer being blocked? Do I need to install nftables or something else to display the blocked IPs? Is there any way to make fail2ban in jail.local send an email about the blocked IP, including whois information? My external fail2ban works perfectly, blocking and sending emails with whois info. If I modify netfilter or anything else within Docker using sh or bash, will it affect the proper functioning of

DocFraggle

How exactly did you add these IPs? They will only show up if you added them via the API. If you just add iptables rules by yourself they won’t show up

zeronemo

I added them from a previous Mailcow, but that doesn’t fundamentally change the fact that the new installation doesn’t display the currently banned IPs. I don’t even know if it’s banning at all. Should I enable the external fail2ban to run instead of the Docker Mailcow fail2ban? In other words, can it be arranged so that the Mailcow fail2ban forwards email hacking attempts to the external local fail2ban, and then the external fail2ban blocks them? Because the external fail2ban also has Postfix and Dovecot regexes, but it’s unlikely that it will block effectively. I find the Mailcow regex much better and more functional, based on my experience with the older email system that ran locally and not in Docker… there, fail2ban didn’t really want to block Dovecot and Postfix attempts.

DocFraggle

zeronemo but that doesn’t fundamentally change the fact that the new installation doesn’t display the currently banned IPs

I disagree, it does 🙂 As I wrote:

If you just add iptables rules by yourself they won’t show up

You can add them in the text field “Blacklisted networks/hosts” (see your screenshot above), then they will be shown below

zeronemo

DocFraggle Yes, but I don’t see any newly banned IPs. Why is that? This is one of my essential questions that hasn’t been answered yet.

DocFraggle

zeronemo any newly banned IPs

Please explain which IPs you mean! Which IPs are missing? Where exactly do you see “banned IPs” which you don’t see on the Fail2Ban page?

zeronemo

DocFraggle I solved it. I fully reset the iptables and restarted mailcow. Probably there were too many banned IPs and this might have caused the whole loggplas to freeze, or a related error. Now it’s starting to write the IP list again, naturally, who knows how long it will last…