Firewall bouncer with postfix not working

Wycofane · January 31, 2024, 6:44pm

Hello guys/girls,

I am hosting a private Mailserver (Mailcow Dockerize) and I installed the postfix collection (parser, scenario etc). It is working and detecting it (does decisions), but then some time afterwards the same IP address gets detected again.

How is that possible, shouldn’t the bouncer block these?

Greetings
Wycofane

iiAmLoz · February 1, 2024, 8:13am

Most likely you havent enabled the DOCKER-USER chain within the firewall bouncer configuration. Because docker uses NAT to mangle the packet you must enable the above chain in configuration as it doesnt use the INPUT chain.

github.com

crowdsecurity/cs-firewall-bouncer/blob/e5b565f5db0973dbcb33ec1ed5744d884761a0dc/config/crowdsec-firewall-bouncer.yaml#L26-L29


      
          iptables_chains:
            - INPUT
          #  - FORWARD
          #  - DOCKER-USER

Wycofane · February 1, 2024, 7:41pm

I think that’s it. I changed the value and now I have to wait an observer. Thank you

Topic		Replies	Views
Same IP keeps getting banned, CTI says it's in community blocklist - firewall rule issue? crowdsec	2	52	November 26, 2024
[docker setup] local bouncer on host doesn't ban IPs	3	1113	September 30, 2023
Firewall bouncer problem	1	270	June 11, 2024
Crowdsec-firewall-bouncer on openwrt not showing as connected to my instance on app.crowdsec.net crowdsec	6	1107	June 14, 2023
Crowdsec-firewall-bouncer in a container	1	462	March 29, 2024

Firewall bouncer with postfix not working

Related topics