What's the best approach to filter/block this unregular slow connections? #2172
Replies: 1 comment 2 replies
-
|
You can automatically add them to the kernel's drop list, I use https://github.com/pepa65/fail2drop which is very lightweight. Edit: Never mind, I cannot see any distinction between actual submissions and idle/bad ones (except when they go over the rate limit). |
Beta Was this translation helpful? Give feedback.
-
|
Interesting, I see in my own logs that I also get a lot of 'submissions' from Latvia in the same IP ranges... |
Beta Was this translation helpful? Give feedback.
-
|
I put now banip on my openwrt firewall with some blocklists and they are blocked. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
i'm relative new to the mail server game and already learned a lot about all the stuff.
One thing i noticed now in the logs is following:
My question is now: what's the best approach to prevent those kind of "attack". They don't try to send mails, those ip addresses just connect and do nothing. The time between the connections from one specific ip is too long to trigger something.
First thing i tried is to put those on the ip block list manually. But this results in cluttering the logs with "Blocked IP address".
Do i have to put some curated block-lists into the firewall and accept some slip through on an email server?
Beta Was this translation helpful? Give feedback.
All reactions