Question How to block non-mail traffic to certain ip?

[michaeljoseph01]

Server operating system version

Ubuntu 20.04.6

Plesk version and microupdate number

18.0.51

I have a single domain on a single cloud VPS server running web and mail service. I have 2 IP addresses on the same WAN adapter. The IP that I want all web traffic to flow through is proxied by cloudflare. The other IP is exposed because I'm running the mail server traffic through it. What would be the best way to block all traffic other than imap or smtp to that one mail server ip address?

Im using cloudflare, the local firewall, mod_security comodo, fail2ban and I just installed immunify360.

Also - I'm actually surprised at just how much malicious traffic I'm seeing considering that my site is a work in progress and has no traffic yet. I'm seeing tons of /.env, xmlrpc, and readme.html/txt requests along with wp-login snooping, including a lot of poking around by a block of IP's that resolve to a group called The Academy of Internet Research llc based out of Hawaii that claims on their website they do whitehat security audits. wtf?

I see that mod_security denies some of these with a 403 like any requests for .env but there's just so many of them in the logs, I see requests from Germany, Iran, China, Russia etc... For now I increased the findtime & bantime windows of the mod_security fail2ban jail, then increased the findtime of the recidive jail and upped the bantime of recidive to 2 weeks in an attempt to shut out the bad actors. Like I said I have no users that need to log in so i'm not too worried about false positives for any of these jails.

What parts of the security stack should I be focusing on?
What are peoples thoughts of the Comodo ruleset vs OWASP?
My thinking right now is that I should probably put more of my attention on cloudflare rules to stop as many bad requests as I can at their edge before the requests even come to my server.

Just a little bit overwhelmed, I'm just getting back into the webmaster game after doing something else for 6 years and don't remember having this much activity on a site that isn't really even linked to yet.

 

[MarkM]

I would probably do it on the network level. A generic deny all rule, and then separate rules to open the certain mail ports that are needed. I'd check with the host and see if this is something the can accommodate.

OWASP is a more restrictive rule set in my opinion.

 

[emilyy3]

I have a single domain on a single cloud VPS server running web and mail service. I have 2 IP addresses on the same WAN adapter. The IP that I want all web traffic to flow through is proxied by cloudflare. The other IP is exposed because I'm running the mail server traffic through it. What would be the best way to block all traffic other than imap or smtp to that one mail server ip address?

Im using cloudflare, the local firewall, mod_security comodo, fail2ban and I just installed immunify360.

Also - I'm actually surprised at just how much malicious traffic I'm seeing considering that my site is a work in progress and has no traffic yet. I'm seeing tons of /.env, xmlrpc, and readme.html/txt requests along with wp-login snooping, including a lot of poking around by a block of IP's that resolve to a group called The Academy of Internet Research llc based out of Hawaii that claims on their website they do whitehat security audits. wtf?

I see that mod_security denies some of these with a 403 like any requests for .env but there's just so many of them in the logs, I see requests from Germany, Iran, China, Russia etc... For now I increased the findtime & bantime windows of the mod_security fail2ban jail, then increased the findtime of the recidive jail and upped the bantime of recidive to 2 weeks in an attempt to shut out the bad actors. Like I said I have no users that need to log in so i'm not too worried about false positives for any of these jails.

What parts of the security stack should I be focusing on?
What are peoples thoughts of the Comodo ruleset vs OWASP?
My thinking right now is that I should probably put more of my attention on cloudflare rules to stop as many bad requests as I can at their edge before the requests even come to my server.

Just a little bit overwhelmed, I'm just getting back into the webmaster game after doing something else for 6 years and don't remember having this much activity on a site that isn't really even linked to yet.

I have the same issue and it's honestly surprising how much unwanted traffic starts hitting a server almost immediately, even when the website isn't publicly launched yet. I'm seeing constant scans for things like .env, xmlrpc.php, wp-login, and other common targets despite not even running WordPress. It can be a bit overwhelming trying to figure out which parts of the security stack are actually making the biggest difference and which ones are just adding more complexity.

I'm also trying to decide where it's best to focus my efforts. My instinct is similar to yours—I feel like blocking as much as possible at Cloudflare's edge makes more sense than letting every request reach the VPS, even if ModSecurity, Fail2Ban, and the local firewall eventually stop it. I'm also curious what others think about using the Comodo ruleset versus OWASP, and whether it's worth tightening firewall rules on the mail IP so only the required SMTP/IMAP traffic is allowed. I'd be interested to hear how more experienced admins approach this, because I'm dealing with the same issue and would like to build a solid setup without overcomplicating it.