Home / server / Questions / 920633
Accepted
Ivan Vučica
Asked: 2018-07-13 03:08:08 +0800 CST

Postfix: Blocking connections on submission port based on geoip

  • 772

Currently I'm reducing failed authentication spam in logs by blocking access to Dovecot and SSHD based on the IP address country of origin. Both services require authentication and I have no users or automation needing access, outside a rather small list of countries.

This is done using a tcpwrappers' aclcheck and a shell script being passed %a and invoking geoiplookup (or geoiplookup6) binary that I happen to have installed on my system. All set up with /etc/hosts.allow, /etc/hosts.deny.

This is enough to get rid of most failed logins.

Postfix, despite being authored by the same person as tcpwrappers, does not do tcpwrappers -- at least in Debian, its various binaries are not linked against libwrap.so.

iptables is, to my knowledge, not applicable; I don't believe it can ask a userspace binary to determine whether an IP packet (such as TCP SYN) should be accepted or rejected.

Is there a convenient way to either make Postfix's daemons that listen for TCP connections, such as master, make use of hosts.allow/hosts.deny? Is tcpd an answer? How would one make proper use of it?

I'm interested in blocking just the smtps and submission ports -- those that allow authentication (and thus allow post-authentication relaying) -- based on the country of origin.

postfix

1 Answers

  1. Best Answer

    iptables is, to my knowledge, not applicable; I don't believe it can ask a userspace binary to determine whether an IP packet (such as TCP SYN) should be accepted or rejected.

    Actually you can use the netfilter (iptables) NFQUEUE to have an external program evaluate packets/connections.

    I'm usually on RHEL and CentOS and download the ip-ranges in CIDR format and then use ipset to create a relatively efficient white- or blacklist in iptables.

    But when you're on for instance Debian/Ubuntu you can easily install the xt_geoip module from the package xtables-addons-dkms to get GeoIP capabilities for your netfilter iptables firewall:

    Install the package:

    apt-get install xtables-addons-dkms

    Download the Geo IP source data and build the binary database: 

    mkdir /usr/share/xt_geoip
cd mkdir /usr/share/xt_geoip
/var/lib/dkms/xtables-addons/2.12/build/geoip/xt_geoip_dl
/var/lib/dkms/xtables-addons/2.12/build/geoip/xt_geoip_build -D /usr/share/xt_geoip GeoIPCountryWhois.csv GeoIPv6.csv

    And then add country aware geoip firewall rules as needed:

    iptables -A INPUT -m geoip  --src-cc NL,UK  -m conntrack --ctstate NEW -j ACCEPT

    of if you prefer: 

    iptables -A INPUT -m geoip  ! --src-cc NL,UK  -m conntrack --ctstate NEW -j REJECT
    • 3