3

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans IP's that are under the specified CIDRs:

This is the jail:

[postfix-sasl]
enabled = true
ignoreip = 127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
filter = postfix-sasl
action_mwl = iptables-allports[name=postfix-sasl]
logpath = /var/log/zimbra.log
bantime = 3600
maxretry = 3

This is an example of a banned IP under one of the CIDRs specified on the ignoreip option (192.168.0.0/16):

Chain f2b-postfix-sasl (1 references)
target     prot opt source               destination         
REJECT     all  --  192.168.11.54        0.0.0.0/0            reject-with icmp-port-unreachable
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

This are the lines matching this IP on the /var/log/fail2ban/log:

2019-03-21 09:21:33,269 fail2ban.filter         [32293]: INFO    [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:48,290 fail2ban.filter         [32293]: INFO    [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:49,044 fail2ban.actions        [32293]: NOTICE  [postfix-sasl] Ban 192.168.11.54

I can see on the fail2ban wiki that the ignoreip can accept space separated values and CIDR notations, from the fail2ban wiki:

# Option: ignoreip.
# Notes.: space separated list of IP's to be ignored by fail2ban..
# You can use CIDR mask in order to specify a range..
# Example: ignoreip = 192.168.0.1/24 123.45.235.65.
# Values: IP Default: 192.168.0.0/24.
#.
ignoreip = 192.168.1.0/24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.