Hi, I have used fail2ban for a while, to block brute force attacks on ssh, imap(s) or submission(s) ports. More because I wanted to reduce the noise in the logs rather than a fear of a broken password.

Then, with nftables, I realised you can achieve the same thing, as long as a TCP connection isn't close. This works very well for SSH, but I then realised it works for a modern IMAP server that supports IDLE, since the connection is kept open, for instance the excellent Dovecot mail server.

Here an example, of nftable ruleset, for dovecot imap(s):

table inet filter {

set banned_imap_ipv4 {
    type ipv4_addr
    flags dynamic,timeout
    timeout 1d
}

set banned_imap_ipv6 {
    type ipv6_addr
    size 65535
    flags dynamic,timeout
    timeout 1d
}

chain input {

    # Limit new imap connections ala fail2ban
    meta nfproto ipv4 tcp dport imaps ct state new,untracked \
    limit rate over 10/minute add @banned_imap_ipv4 { ip saddr }

    meta nfproto ipv6 tcp dport imaps ct state new,untracked \
    limit rate over 10/minute add @banned_imap_ipv6 { ip6 saddr }

    # Reject the traffic explicitly
    ip saddr @banned_imap_ipv4 tcp dport imaps reject with icmp type admin-prohibited
    ip6 saddr @banned_imap_ipv6 tcp dport imaps reject with icmpv6 type admin-prohibited

    tcp dport { imap, imaps } ct state new counter accept \
    comment "Accept imap/imaps connections"

}

}

Surprisingly, this is working very well with Dovecot, and various modern clients like Evolution or Thunderbird, as well as K9 on Android.

There is also a way to save the rules before restarting the firewall, which works very well as well:

# nft list set inet filter banned_imap_ipv4 table inet filter { set banned_imap_ipv4 { type ipv4_addr size 65535 flags dynamic,timeout timeout 1d elements = { 162.142.125.214 timeout 1d expires 23h44m16s600ms } } }

Now, the question I have is this.

I can limit new TCP connections to a reasonable amount, like 10 per minute, because I know I will not try to send that amount of emails from a single IP.

However, is there an option, in Postfix, to keep the TCP connection opened for submission(s) protocols (ports 465 or 587)

Thanks for your insights.