Hey all, i’ve decided I should probably setup something else to help block nefarious IP addresses. I’ve been looking into CrowdSec and Fail2Ban but i’m not really sure the best one to use.
My setup is OpnSense -> Nginx Proxy Manager -> Servers. I think I need to setup CrowdSec/Fail2Ban on the Nginx Proxy Manager to filter the access logs, then ideally it would setup the blocks on OpnSense - but i’m not sure that can be done?
Any experience in a setup like this? I’ve found a few guides but some of them seem fairly outdated.
Edit: thanks everybody for the great info. General consensus seems to be with crowdsec so I’ll go down that path and see how it goes.
Our small mail server is doing OK. Incoming spam is an issue but not a massive problem. Outgoing spam doesn’t exist. Once a year the IP ends up on the Microsoft blocklist but using the deliverability form to submit mitigation requests is easy enough and takes half a day or so to sort out.
I’m looking forward to seeing what the Thunderbird team does with Stalwart.
That reminds me I’ve been meaning to spin up a server, install Stalwart and test it out.