Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small mail server at home and quite a restrictive filtering rules. I use logwatch and could see that 80 to 90% connections are rejected by my restrictive filtering rules. Most rejection result from rbl_client.

I'm desperately looking for a fail2ban configuration file example showing how to filter IPs spamming my server. I wish the ban would be for a long period (i.e. 1 month).

I also had a SYN flooding attempt on my mail server that I blocked using a firewall rule set by hand. Could fail2ban detect these too ?

share|improve this question

migrated from Apr 2 '13 at 8:42

This question came from our site for system and network administrators.

I do not think it is a good idea. I would be surprised if any significant number of those addresses gets reused. Why create more junk iptables rules? – Alex P. Apr 1 '13 at 18:03
up vote 4 down vote accepted

I've just got sick of all the RBL spammers filling my logs, so I've setup my Postfix to ban them.

After doing so, load dropped because they were a lot!

Be aware that you have to implement some way of cleaning the banned list.

I'm planing to restart fail2ban on weekly basis.

Check out these rules:

Add them in: /etc/fail2ban/filter.d/postfix.conf (that's in Debian System!)

Also good to read this (search for fail2ban): (some snippets from there).

In short:

  1. In jail.conf set:

    enabled  = true
  2. Good to do if you're using dovecot (from link above): Create /etc/fail2ban/filter.d/dovecot-pop3imap.conf and add to it:

    failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \   (auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
    ignoreregex =
  3. Add section in jail.conf or jail.local:

    enabled = true
    port = pop3,pop3s,imap,imaps
    filter = dovecot-pop3imap
    logpath = /var/log/mail.log
  4. Restart fail2ban and check iptables -nvL if the chains for postfix and courier are added. BEWARE: This is for Debian based systems. Check files paths for RH or others.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.