I am trying to set up some firewall for my 10.5 server, but I just cannot seem to get it to work. The main aim is to try to stop the constant brute force mail login attempts.
To this end I installed fail2ban, to spot and ban the failed logins. For the most part this works, ie the mechanics of submitting the banned IP addresses and sending me an email to that effect is accomplished. If I start up a terminal session I get dozens of IP addresses listed with the following command:
sudo ipfw list
With an entry looking like:
12345 deny tcp from 184.108.40.206 to any in
But, the ban just isn't effective - the same IP address will try again later, sometimes every few seconds for hours.
When I check the fail2ban log it complains (after it has detected a malicious login attempt multiple times):
"WARNING [sasl-ipfw] 220.127.116.11 already banned"
I have tried formatting the ban in different ways:
12345 deny tcp from 18.104.22.168 to 127.0.0.1 dst-port 25 12345 deny tcp from 22.214.171.124 to 192.168.123.123 dst-port 25
But just not making any difference. I even tried just a local network network ban to the web service:
12345 deny tcp from 192.168.123.122 to 192.168.123.123 dst-port 80
But again that does not have any effect. The other rules, seem to be default, in the IPFW list look like:
12300 allow log logamount 1000 tcp from any to any established 12301 allow log logamount 1000 tcp from any to any out 12302 allow log logamount 1000 tcp from any to any dst-port 22 …
and one final rule in the list (which I read somewhere cannot be changed):
65535 allow ip from any to any
Server admin app indicates that the firewall service is running, there are no "deny" listings in the ipfw log. The entries patched in to IPFW by fail2ban do not appear in the Server Admin entries anywhere, nor in the ipfw.conf or ipfw.conf.apple files (so I'm not sure where they are stored). But I do see them when I get "ipfw list" in the terminal and they are listed in the "Active Rules" tab of the Firewall section in Server Admin.
Thanks for any help on this issue.