fail2ban for dnsblog

**UncleSam** · Sep 19th 2016

Hello,

(Attention: please read the following post about whitelisted entries!)

currently I was under attack from a host which was on a dns blocklist (dnsbl) but was keep on trying with about 20 connections per second. So I decided to do something against it because postscreen blocked it but produced a lot of used cpu power from postscreen as well as fail2ban. Maybe this could help someone else too:

First I created the file /etc/fail2ban/filter.d/postfix-dnsblog.conf file containing --> https://github.com/jannickfahl…tFix/postfix-dnsblog.conf
After that I created the following entry inside /etc/fail2ban/jail.conf:

Code

[postfix-dnsblog]
enabled = true
port = smtp,465,submission
logpath = /var/log/mail.log
maxretry = 10
bantime = 300

This is banning after 10 dnsblog entries for 300 seconds (5 minutes). And for me it is saving a lot of cpu at the moment

**UncleSam** · Sep 20th 2016

Additional information:
After some hours of testing I found a small mistake: dnsblog also logs if it was a whitelist entry. So all in all whitelisted mail servers get banned by this howto too. So this is not the final solution

**Speddy** · Dec 5th 2016

please follow ling https://github.com/jannickfahl…tFix/postfix-dnsblog.conf

mrpink · Dec 5th 2016

@Speddy

What do you want to say us with that? The link is the same as in post 1 and the problem still persist, that you will also block whitelisted IP addresses.

**Nuxwin** · Dec 7th 2016

@mrpink

The link in the first post is mistaken. Therefore, @Speddy has provided the right link

**Speddy** · Dec 7th 2016

Thanks Nuxwin I meant that.

**UncleSam** · Dec 7th 2016

link is now correct - there were some special chars at the end ... no idea why

fail2ban for dnsblog

Share

Daily visitors