0

I got a problem with my host / docker setting as follows: Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I defined a jail.local

[postfix-sasl]
enabled  = true
port     = smtpd
filter   = postfix-sasl
logpath  = /var/lib/docker/volumes/smtp2/_data/mail.log
bantime  = 604800
maxretry = 5
action = docker-action

and a filter postfix-sasl.conf

[INCLUDES]
before = common.conf

[Definition]
_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds]
_port = (?::\d+)?
failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5)            authentication failed(:[ A-Za-z0-9+/:]*={0,2})?\s*$

ignoreregex = authentication failed: Connection lost to authentication server$
[Init]

journalmatch = _SYSTEMD_UNIT=postfix.service

and an action as docker-action.conf

[Definition]  
actionstart =
actionstop =
actioncheck = iptables -n -L FORWARD | grep -q 'DOCKER[ \t]'
actionban = iptables -I DOCKER 1 -s <ip> -j DROP
actionunban = iptables -D DOCKER -s <ip> -j DROP

All seems to work fine, even got

2018-08-14 16:51:24,048 fail2ban.actions        [26209]: WARNING [postfix-sasl] 181.214.206.133 already banned

and in iptables -S the following entry, as I wanted:

-A DOCKER -s 181.214.206.133/32 -j DROP

But in my container still all the attemps get in like this

Aug 14 17:34:28 smtp2 postfix/smtpd[16114]: warning: unknown[181.214.206.133]: SASL LOGIN authentication failed: authentication failure
Aug 14 17:34:29 smtp2 postfix/smtpd[16114]: disconnect from unknown[181.214.206.133] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Aug 14 17:34:52 smtp2 postfix/smtpd[16114]: connect from unknown[181.214.206.133]

Output from iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION
-N DOCKER-USER
-N f2bd-postfix-sasl
-N fail2ban-postfix
-N ufw-after-forward
-N ufw-after-input
-N ufw-after-logging-forward
-N ufw-after-logging-input
-N ufw-after-logging-output
-N ufw-after-output
-N ufw-before-forward
-N ufw-before-input
-N ufw-before-logging-forward
-N ufw-before-logging-input
-N ufw-before-logging-output
-N ufw-before-output
-N ufw-logging-allow
-N ufw-logging-deny
-N ufw-not-local
-N ufw-reject-forward
-N ufw-reject-input
-N ufw-reject-output
-N ufw-skip-to-policy-forward
-N ufw-skip-to-policy-input
-N ufw-skip-to-policy-output
-N ufw-track-forward
-N ufw-track-input
-N ufw-track-output
-N ufw-user-forward
-N ufw-user-input
-N ufw-user-limit
-N ufw-user-limit-accept
-N ufw-user-logging-forward
-N ufw-user-logging-input
-N ufw-user-loggireject-input
-A INPUT -j ufw-track-input
-A FORWARD -p tcp -m multiport --dports 25 -j fail2ban-postfix
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j ufw-track-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A DOCKER -s 69.10.48.187/32 -j DROP
-A DOCKER -s 181.214.206.133/32 -j DROP
-A DOCKER-ISOLATION -j RETURN
-A DOCKER-USER -j RETURN

Output of iptables -vnL FORWARD | grep docker

0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate  ELATED,ESTABLISHED 
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0 
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0

Can anyone explain to me, why those requests are still getting forwared to the docker container? Am I missing out on something?

  • Where in iptables is the DOCKER chain called? – RalfFriedl Aug 15 '18 at 8:47
  • Does the Output from iptables -S answer your question? Or is there anywhere else, I have to get the information from? – John Daniels Aug 15 '18 at 10:44
  • What is the output of iptables -vnL FORWARD | grep docker, after there have been connections to your docker container? – RalfFriedl Aug 15 '18 at 10:58
  • 0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0 – John Daniels Aug 16 '18 at 13:58
  • Please add that to the question by using edit below the question. This is barely readable. – RalfFriedl Aug 16 '18 at 16:56
0

Your DOCKER chain is only called from FORWARD. As you can see from the numbers zero, the rules are not reached. Try to call the DOCKER chain from INPUT, too.

  • Thank you very much, this seems to do the Trick. Sorry, I sadly cant upvote yout answer due to my low reputation. But I am really grateful for your help :-) – John Daniels Aug 17 '18 at 17:50
  • @JohnDaniels what change did you do and how, to fix this. thanks. – iajnr Dec 6 '18 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.