I have Fail2Ban running on my Centos Server. (Config below)
In my var/log/messages I noticed something really weird:
Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 126.96.36.199 already banned
I configured Fail2Ban to add the banned IP to iptables.
[postfix] enabled = true filter = postfix action = iptables port = smtp,ssmtp filter = postfix logpath = /var/log/maillog bantime = 43200 maxretry = 2
[INCLUDES] before = common.conf [Definition] failregex = reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1 reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1 reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1 reject: RCPT from (.*)\[<HOST>\]: (.*)@yahoo.com.tw ignoreregex =
My question is how can anybody that has already been blocked in
iptables still connect to the server?