Fail2Ban封禁IP后iptables显示规则存在,但仍无法阻止该IP连接邮件服务器的问题求助
Fail2Ban封禁IP后iptables显示规则存在,但仍无法阻止该IP连接邮件服务器的问题求助
我正在使用Ubuntu 22.04 LTS,想通过fail2ban阻止恶意IP重复连接我的邮件服务器。目前fail2ban已经在iptables里生成了看起来正常的规则,但被封禁的IP还是能继续连接服务器,这让我很困惑。
我执行了iptables --list命令,输出如下:
Chain INPUT (policy ACCEPT) target prot opt source destination f2b-postfix-sasl tcp -- anywhere anywhere multiport dports smtp Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain f2b-postfix-sasl (1 references) target prot opt source destination REJECT all -- 80.94.95.184 anywhere reject-with icmp-port-unreachable REJECT all -- 141.98.10.150 anywhere reject-with icmp-port-unreachable RETURN all -- anywhere anywhere
从这个输出看,规则配置是没问题的,两个恶意IP已经被加入到f2b-postfix-sasl链里,策略是拒绝所有连接。但我查看/var/log/mail.log时,发现这些IP依旧能连接服务器。
同时,fail2ban的日志也显示它一直在尝试封禁同一个IP,提示该IP已经被封禁但还是能检测到连接:
2023-06-30 09:47:54,108 fail2ban.actions [4183541]: NOTICE [postfix-sasl] Ban 80.94.95.184 2023-06-30 09:48:02,011 fail2ban.filter [4183541]: INFO [postfix-sasl] Found 141.98.10.150 - 2023-06-30 09:48:02 2023-06-30 09:48:02,128 fail2ban.actions [4183541]: WARNING [postfix-sasl] 141.98.10.150 already banned 2023-06-30 09:48:52,314 fail2ban.filter [4183541]: INFO [postfix-sasl] Found 141.98.10.150 - 2023-06-30 09:48:52 2023-06-30 09:49:40,343 fail2ban.filter [4183541]: INFO [postfix-sasl] Found 141.98.10.150 - 2023-06-30 09:49:40 2023-06-30 09:50:31,453 fail2ban.filter [4183541]: INFO [postfix-sasl] Found 141.98.10.150 - 2023-06-30 09:50:31 2023-06-30 09:50:31,511 fail2ban.actions [4183541]: WARNING [postfix-sasl] 141.98.10.150 already banned
看起来这些IP明明已经被封禁了,但还是能继续连接我的服务器,有没有大佬能给我一些解决建议?非常感谢!
备注:内容来源于stack exchange,提问作者Deckard
相关产品推荐
相关产品推荐

