Hi there, I am hosting a service for mainly me and also some family members. I want it to become more.

Currently the chain just as follows: interwebz <-> UDM <-> npm <-> services. The services are mostly run in VMs or LXCs, npm runs in docker, accompanied by one Adguard home instance and another AGH instance in an LXC.

I now want to add f2b to this whole chain. I’ve installed f2b in the OS which runs docker (and therefore npm) (VM1) and also in the OS of my existing service (VM2). Both VMs use Ubuntu as their OS.

What I already figured out thru testing and reading is, that f2b in VM2 acts as expected when the jail is triggered, and sets the block. But nftables/ufw don’t block connections coming from external, as they are coming thru npm. f2b sees and uses the public IP for the checks/bans.

So now I am thinking how to solve that.

  1. Keep f2b on VM2 and let it set the bans on VM1 over SSH. That’s what some people do or so I’ve read.
  2. Use f2b on VM1, let it check logs on VM2 and then set the bans. That would also be possible over SSH, I’d guess. But I didn’t read up on it yet.

So, what’s your opinion? How do you fine folks handle that in your environment? Option 2 seems to be more elegant, as it would be “at the entry” and let’s me easily add additional services later. But I don’t know, if that’s a path worth digging in to.

  • galacticworm@piefed.socialEnglish
    2·
    12 hours ago

    I have a similar setup to you, but I run caddy instead of npm. I recently added a log analyzer to caddy and noticed a bunch of unauthorized hits I thought I could do something about…

    I added a region based firewall rule for the port forward address on my UniFi gateway only allowing incoming traffic from my own country. I couldn’t do a global region block as I have some legitimate incoming traffic from the USA, so I went with a rule targeting traffic to the reverse proxy ip specifically. It still managed to let in some random bot traffic, so I also added a block region rule above the allow region rule (both to the reverse proxy) blocking countries like Russia, china, North Korea etc…

    If you don’t need to allow most of the world, it is an easy fix to do this at your gateway (I note you have a udm)

    • nibbs@lemmy.zipOPEnglish
      1·
      7 hours ago

      Thank you for suggesting the region block on Unifi, that’s a good tip.

      I have that previously set in place globally under settings -> security -> protection -> region blocking.
      So on a less sophisticated level and not as granular as you.
      Yours seems to be much better and I will take a look at it later. At the moment I have way too many ideas and projects boiling, to add yet another one… ;)