I got a problem with my host / docker setting as follows: Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I defined a jail.local

enabled  = true
port     = smtpd
filter   = postfix-sasl
logpath  = /var/lib/docker/volumes/smtp2/_data/mail.log
bantime  = 604800
maxretry = 5
action = docker-action

and a filter postfix-sasl.conf

before = common.conf

_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds]
_port = (?::\d+)?
failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5)            authentication failed(:[ A-Za-z0-9+/:]*={0,2})?\s*$

ignoreregex = authentication failed: Connection lost to authentication server$

journalmatch = _SYSTEMD_UNIT=postfix.service

and an action as docker-action.conf

actionstart =
actionstop =
actioncheck = iptables -n -L FORWARD | grep -q 'DOCKER[ \t]'
actionban = iptables -I DOCKER 1 -s <ip> -j DROP
actionunban = iptables -D DOCKER -s <ip> -j DROP

All seems to work fine, even got

2018-08-14 16:51:24,048 fail2ban.actions        [26209]: WARNING [postfix-sasl] already banned

and in iptables -S the following entry, as I wanted:


But in my container still all the attemps get in like this

Aug 14 17:34:28 smtp2 postfix/smtpd[16114]: warning: unknown[]: SASL LOGIN authentication failed: authentication failure
Aug 14 17:34:29 smtp2 postfix/smtpd[16114]: disconnect from unknown[] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
Aug 14 17:34:52 smtp2 postfix/smtpd[16114]: connect from unknown[]

Output from iptables -S

-N f2bd-postfix-sasl
-N fail2ban-postfix
-N ufw-after-forward
-N ufw-after-input
-N ufw-after-logging-forward
-N ufw-after-logging-input
-N ufw-after-logging-output
-N ufw-after-output
-N ufw-before-forward
-N ufw-before-input
-N ufw-before-logging-forward
-N ufw-before-logging-input
-N ufw-before-logging-output
-N ufw-before-output
-N ufw-logging-allow
-N ufw-logging-deny
-N ufw-not-local
-N ufw-reject-forward
-N ufw-reject-input
-N ufw-reject-output
-N ufw-skip-to-policy-forward
-N ufw-skip-to-policy-input
-N ufw-skip-to-policy-output
-N ufw-track-forward
-N ufw-track-input
-N ufw-track-output
-N ufw-user-forward
-N ufw-user-input
-N ufw-user-limit
-N ufw-user-limit-accept
-N ufw-user-logging-forward
-N ufw-user-logging-input
-N ufw-user-loggireject-input
-A INPUT -j ufw-track-input
-A FORWARD -p tcp -m multiport --dports 25 -j fail2ban-postfix
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j ufw-track-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output

Output of iptables -vnL FORWARD | grep docker

0 0 ACCEPT all -- * docker0 ctstate  ELATED,ESTABLISHED 
0 0 DOCKER all -- * docker0 
0 0 ACCEPT all -- docker0 !docker0 
0 0 ACCEPT all -- docker0 docker0

Can anyone explain to me, why those requests are still getting forwared to the docker container? Am I missing out on something?

  • Where in iptables is the DOCKER chain called? – RalfFriedl Aug 15 '18 at 8:47
  • Does the Output from iptables -S answer your question? Or is there anywhere else, I have to get the information from? – John Daniels Aug 15 '18 at 10:44
  • What is the output of iptables -vnL FORWARD | grep docker, after there have been connections to your docker container? – RalfFriedl Aug 15 '18 at 10:58
  • 0 0 ACCEPT all -- * docker0 ctstate RELATED,ESTABLISHED 0 0 DOCKER all -- * docker0 0 0 ACCEPT all -- docker0 !docker0 0 0 ACCEPT all -- docker0 docker0 – John Daniels Aug 16 '18 at 13:58
  • Please add that to the question by using edit below the question. This is barely readable. – RalfFriedl Aug 16 '18 at 16:56

Your DOCKER chain is only called from FORWARD. As you can see from the numbers zero, the rules are not reached. Try to call the DOCKER chain from INPUT, too.

  • Thank you very much, this seems to do the Trick. Sorry, I sadly cant upvote yout answer due to my low reputation. But I am really grateful for your help :-) – John Daniels Aug 17 '18 at 17:50
  • @JohnDaniels what change did you do and how, to fix this. thanks. – iajnr Dec 6 '18 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.