These are my firewall rules, they worked as expected… until today:
add action=drop chain=forward comment="gesperrte POP3 IPs blockieren" disabled=no src-address-list=pop3_blacklist
add action=drop chain=forward comment="gesperrte RDP IPs blockieren" disabled=no src-address-list=rdp_blacklist
add action=drop chain=forward comment="gesperrte SSH IPs blockieren" disabled=no src-address-list=ssh_blacklist
add action=drop chain=forward comment="gesperrte FTP IPs blockieren" disabled=no src-address-list=ftp_blacklist
add action=jump chain=forward comment="nach 4 neuen SSH Verbindungen innerhalb einer Minute IP fuer 1 Woche auf die Blocklist" connection-state=new disabled=no dst-port=22 jump-target="log and add to SSH addr-list" protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=!unsernetz
add action=jump chain=forward comment="nach 6 neuen RDP Verbindungen innerhalb einer Minute IP fuer 1 Woche auf die Blocklist" connection-state=new disabled=no dst-port=3389 jump-target="log and add to RDP addr-list" protocol=tcp src-address-list=rdp_stage5
add action=add-src-to-address-list address-list=rdp_stage5 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=3389 protocol=tcp src-address-list=rdp_stage4
add action=add-src-to-address-list address-list=rdp_stage4 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=3389 protocol=tcp src-address-list=rdp_stage3
add action=add-src-to-address-list address-list=rdp_stage3 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=3389 protocol=tcp src-address-list=rdp_stage2
add action=add-src-to-address-list address-list=rdp_stage2 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=3389 protocol=tcp src-address-list=rdp_stage1
add action=add-src-to-address-list address-list=rdp_stage1 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=3389 protocol=tcp src-address-list=!unsernetz
add action=accept chain=forward comment="4 falsche POP3 Anmeldungen pro Minute erlauben" content="-ERR Authentication failed" disabled=no dst-address-list=!unsernetz dst-limit=1/1m,4,dst-address/1m protocol=tcp src-port=110
add action=accept chain=forward comment="4 falsche FTP Anmeldungen pro Minute erlauben" content="530 Login incorrect" disabled=no dst-address-list=!unsernetz dst-limit=1/1m,4,dst-address/1m protocol=tcp src-port=21
add action=jump chain=forward comment="nach der 5. falschen POP3 Anmeldung fuer 1 Woche auf die Blocklist" content="-ERR Authentication failed" disabled=no dst-address-list=!unsernetz jump-target="log and add to POP3 addr-list" protocol=tcp src-port=110
add action=jump chain=forward comment="nach der 5. falschen FTP Anmeldung fuer 1 Woche auf die Blocklist" content="530 Login incorrect" disabled=no dst-address-list=!unsernetz jump-target="log and add to FTP addr-list" protocol=tcp src-port=21
add action=log chain="log and add to FTP addr-list" disabled=no log-prefix=""
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=1w chain="log and add to FTP addr-list" disabled=no
add action=log chain="log and add to SSH addr-list" disabled=no log-prefix=""
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w chain="log and add to SSH addr-list" disabled=no
add action=log chain="log and add to RDP addr-list" disabled=no log-prefix=""
add action=add-src-to-address-list address-list=rdp_blacklist address-list-timeout=1w chain="log and add to RDP addr-list" disabled=no
add action=log chain="log and add to POP3 addr-list" disabled=no log-prefix=""
add action=add-dst-to-address-list address-list=pop3_blacklist address-list-timeout=1w chain="log and add to POP3 addr-list" disabled=no
Usually the attack is detected, logged and the IP gets blocked… but today:
As you can see it is always the same IP, so why it is not added to the address list and gets blocked? When I looked again after two minutes it finally shows up in the address list and gets blocked. Is the add-dst-to-address-list process overloaded with this much requests?
EDIT:
Do you think adding “limit rate” to the jump command would help?