Hey all, i’ve decided I should probably setup something else to help block nefarious IP addresses. I’ve been looking into CrowdSec and Fail2Ban but i’m not really sure the best one to use.

My setup is OpnSense -> Nginx Proxy Manager -> Servers. I think I need to setup CrowdSec/Fail2Ban on the Nginx Proxy Manager to filter the access logs, then ideally it would setup the blocks on OpnSense - but i’m not sure that can be done?

Any experience in a setup like this? I’ve found a few guides but some of them seem fairly outdated.

Edit: thanks everybody for the great info. General consensus seems to be with crowdsec so I’ll go down that path and see how it goes.

  • catloaf@lemm.ee
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    24
    ·
    21 hours ago

    Why not just put everything behind a VPN and stop worrying?

      • catloaf@lemm.ee
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        9
        ·
        20 hours ago

        It doesn’t, but I wouldn’t recommend selfhosting email for a small org. The low price of Office 365 or whatever Google is calling their business product now is far cheaper than the anguish of running your own server and dealing with spam, both incoming and making sure there’s none outgoing, and making sure your recipient servers aren’t considering your spam.

        • maniacalmanicmania@aussie.zone
          link
          fedilink
          English
          arrow-up
          4
          ·
          edit-2
          20 hours ago

          Our small mail server is doing OK. Incoming spam is an issue but not a massive problem. Outgoing spam doesn’t exist. Once a year the IP ends up on the Microsoft blocklist but using the deliverability form to submit mitigation requests is easy enough and takes half a day or so to sort out.

          I’m looking forward to seeing what the Thunderbird team does with Stalwart.

          That reminds me I’ve been meaning to spin up a server, install Stalwart and test it out.

        • jrgd@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          20 hours ago

          If you’re running an email server for more than a handful of persistent users, I’d probably agree. However, there are self-host solutions that do a decent job of being ‘all-in-one’ (MailU, Mailcow, Docker-Mailserver) that can help perform a lot of input filtering.

          If your small org just needs automation emails (summaries, password resets), it’s definitely feasible to do actually, as long as you have port 25 available in addition to 465, 587 and you can assign PTR records on reverse DNS. Optionally you should use a common TLD for your domain as it will be less likely to be flagged via SpamAssassin. MXToolbox and Mail-Tester together offer free services to help test the reliability of your email functionality.

    • The Quuuuuill@slrpnk.net
      link
      fedilink
      English
      arrow-up
      5
      ·
      20 hours ago

      VPNs are not a panacea by any stretch of the imagination. they are good for certain use cases but from OP’s description they would do next to nothing

      • catloaf@lemm.ee
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        3
        ·
        20 hours ago

        It would protect all the services. Instead of having to secure each one, you only expose the VPN server and connect to that. You don’t have to worry about North Korean hackers breaching your services if they’re not exposed at all, only the single VPN service. Less attack surface, less worry.

        • JASN_DE@feddit.org
          link
          fedilink
          English
          arrow-up
          3
          ·
          14 hours ago

          And basically useless if you need external users to be able to connect to the services.

        • The Quuuuuill@slrpnk.net
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          13 hours ago

          This is a scenario where a single node VPN would reduce, not increase OP’s security stance. You do have to worry about NK hackers breaching your services because they’re all exposed through the single node VPN server. Same attack surface, less knowledge needed to hit the target with the payload.