szaimen
commented
1 day ago @Silun and apache listens on port 443?
Open szaimen opened 1 day ago
szaimen
commented
1 day ago @Silun and apache listens on port 443?
Silun
commented
1 day ago The outside apache listens on 80/443, does SSL Termination and forwards HTTP requests to port 11000 on the AIO-apache-container. After fail2ban bans an IP, the mastercontainer can't be reached (timeout) but the nextcloud interface is not impacted in any way from what I can tell.
szaimen
commented
1 day ago Hm... I wonder if you would need a different chain then? https://github.com/szaimen/aio-fail2ban/blob/fd05c5942a9023e232c037703d853f0b4c38f3ef/start.sh#L38
Honestly I am not too familiar with fail2ban regarding this and could need a little help on solving this
szaimen
commented
1 day ago Usually these ports should be blocked: https://github.com/szaimen/aio-fail2ban/blob/fd05c5942a9023e232c037703d853f0b4c38f3ef/start.sh#L30
Silun
commented
1 day ago If it were working as it should, then access to the whole server should be blocked on those ports? Or just access to all docker containers?
szaimen
commented
1 day ago If it were working as it should, then access to the whole server should be blocked on those ports? Or just access to all docker containers?
I think in best case to the whole server on these ports - at least that was the idea...
Silun
commented
1 day ago I checked iptables -S and I can see the f2b rules:
-A DOCKER-USER -p udp -j f2b-nextcloud
-A DOCKER-USER -p tcp -j f2b-nextcloud
-A DOCKER-USER -j RETURN
-A f2b-nextcloud -s 111.222.333.6/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-nextcloud -s 111.222.333.139/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-nextcloud -s 111.222.333.13/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-nextcloud -j RETURNThose are located at the very end. At the start of the list, I have those rules:
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPTIs this just a case of the server firewall having its rules earlier in the processing order, thus granting access before the f2b block rules are evaluated at the end?
szaimen
commented
1 day ago Thanks for debugging this a bit! :)
Is this just a case of the server firewall having its rules earlier in the processing order, thus granting access before the f2b block rules are evaluated at the end?
Honestly I dont know :/
Silun
commented
1 day ago It seems that docker can be quite finnicky with the chains, changing up their order of processing. That would all make sense in context. Thank you :)
szaimen
commented
1 day ago So does it work or not? :) And if not can we do something about it?
Silun
commented
1 day ago It is not working for me. I believe this is the situation:
Apache listens on 443, and forwards to AIO-apache via 127.0.0.1:11000 as suggested in the AIO setup instructions. Port 8080 gets directly forwarded to the master container, without proxy.
I believe this is what is going on:
If the f2b block rules work for you, what is your setup? Do you have the AIO-apache listening on 443 directly?
Addendum:
I am not quite sure if f2b should be blocking system-wide. I believe if you want aio-f2b to block system-wide, it should use a chain like INPUT (or PREROUTING?), which gets processed before any traffic goes into docker. If the chain in which f2b does the blocking is DOCKER-USER it will only be applied after traffic enters the realm of docker, which for a reverse proxy setup is too late, because at that point the source IP will have changed to 127.0.0.1 already.
I am not sure whether that should be fixed or merely hinted at in the container description. Because after all, it is the admin who actively circumvents the blocking - like I did - unknowingly. So maybe pointing out that it won't block when NC is reverse proxied via loopback is more sensible?
Edit: I understand that f2b is expected to ban offenders. On the other hand, I would expect docker stuff to stay inside docker, so it is counterintuitive for me that an AIO-f2b container would block system-wide. But that is just me and my intuition. Just saying this to explain my thoughts above.
I am using nextcloud AIO behind an apache reverse proxy. The client IP is recognized from inside the nextcloud webinterface just fine.
fail2ban log:
Originally posted by @Silun in https://github.com/szaimen/aio-fail2ban/issues/9#issuecomment-2494770469