I've searched around a great deal with this, but can't manage to come up with a solution.
The easiest way of explaining it, is I used to have just 1 email server, now I have 2. The 1st email server accepts SSL connections only, and forwards non-SSL (ie 110, 143 etc) to the second server (this is in place because clients have their emails set up and working with the DNS entry that points to the first email server).
I want to use Fail2ban on the 2nd server to block failed logins, but I can't figure out how, as Dovecot only 'sees' the 1st server's IP address.
I can turn on logging on iptables on server 1, but cannot see how to 'relate' the connection to the failed password attempt on server2.