Netfilter regex syntax

joe782

Struggling to get custom regex filters to work - hoping someone can help with the syntax.

postfix/postscreen[\d+]: DNSBL rank \d+ for [([0-9a-fA-F:.]+)]:\d+
postfix/postscreen[\d+]: PREGREET \d+ after \d+(.\d+)? from [([0-9a-fA-F:.]+)]:\d+:.*

Work when I check against logs (i.e. sudo docker logs mailcowdockerized-postfix-mailcow-1 2>&1 | grep -P ‘postfix/postscreen[\d+]: DNSBL rank \d+ for [([0-9a-fA-F:.]+)]:\d+’) - but netfilter does not pick up any new matches.

Netfilter in general is working fine - for example the following three regex rows match and ban regularly:
warning: non-SMTP command from .[([0-9a-f.:]+)]:.+
NOQUEUE: reject: RCPT from \S+[([0-9a-fA-F.:]+)]: 550 5.1.\d+.User unknown
NOQUEUE: reject: RCPT from [([0-9a-fA-F.:]+)]:\d+:.*blocked using

Any assistance with the 1st two would be appreciated!

ETNyx

Your reqexp is not escaped,.. If you want to match character [ you need to escape it.

In this part,… [([0-9a-fA-F:.]+)]

joe782

Thanks. Is the escape with $$ or something else? Can you provide an escaped version of my regexp? I tried the following - none worked.

postfix/postscreen$$\d+$$: PREGREET \d+ after [0-9.]+ from $$([0-9a-fA-F:.]+)$$:\d+:
postfix/postscreen$$\d+$$: DNSBL rank \d+ for $$([0-9a-fA-F:.]+)$$:\d+
postfix/postscreen$$[0-9]+$$: PREGREET [0-9]+ after [0-9]+(.[0-9]+)? from $$[0-9a-fA-F:.]+$$:[0-9]+:.*
postfix/postscreen$$[0-9]+$$: DNSBL rank [0-9]+ for $$([0-9a-fA-F:.]+)$$:[0-9]+
postfix/postscreen$$[0-9]+$$: PREGREET [0-9]+ after [0-9]+(.[0-9]+)? from $$([0-9a-fA-F:.]+)$$:[0-9]+:.*
DNSBL rank [0-9]+ for $$([0-9a-fA-F:.]+)$$:[0-9]+
PREGREET [0-9]+ after [0-9]+(.[0-9]+)? from $$([0-9a-fA-F:.]+)$$:[0-9]+:.*