• Introducing WebPros Cloud - a fully managed infrastructure platform purpose-built to simplify the deployment of WebPros products !  WebPros Cloud enables you to easily deliver WebPros solutions — without the complexity of managing the infrastructure.
    Join the pilot program today!
  • Support for BIND DNS has been removed from Plesk for Windows due to security and maintenance risks.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS.

Issue block per ip in firewall rules

Pavlo.UA

Basic Pleskian
Server operating system version
CentOS Linux 7.9.2009 (Core)
Plesk version and microupdate number
Plesk Obsidian Version 18.0.49
Hello all!)

I have a BIG 1 rule in my firewall, that blocks connections to server on mail ports (25,110,143,993,995,2525).
Why it is BIG? Because in this rule i have a large list of IP addresses and IP blocks/nets (like 46.148.40.0/24). I collect IP addresses which appears in fail2ban (recidive) list with more than 50 authentication failures per day.

Question:
Why somebody can still connect from IP addresses which are already in "banned" list in firewall rule?
Does firewall rule has an limit for IP addresses quantity? (may be limit reached and this rule doesn't work at all)
Does this logic works at all? (collect and ban IP's and IP blocks/nets)

It worked like a charm 2 years, but now I see connections from banned IP's ((

Thank you in advance.

P.S. the rule: Deny incoming from [many IP's] on ports [all mail ports with /tcp].
 
Are you using iptables? In that case, you could check with
# iptables --list
if the blocked IPs are all there. Are they?
 
Are you using iptables? In that case, you could check with
# iptables --list
if the blocked IPs are all there. Are they?

Thank you for fast reply! :)
Yes, I use iptables and they all are there... this one too:
DROP tcp -- 46.148.40.0/24 anywhere tcp dpt:smtp

But 12/26/2022 I added this subnet in firewall and 12/27/2022 I still see new connections from it. Today do not see already.
How can it be? Maybe these were not connections, but only attempts?
 
Back
Top