Hello everyone!
Unfortunately, the solution to this issue: — Incomming connections are beeing dropped instead of being forwarded according to the firewall rule — is causing other problems when used in conjunction with a reverse proxy server and Fail2ban:
If someone repeatedly tries to log in to a server behind IPFire with incorrect credentials, it is not the source IP address that is blocked by the destination server’s Fail2ban, but the IP address of the reverse proxy server.
That’s pretty silly, because it cuts off all incoming traffic to this destination server.
I thought DNAT only rewrites the destination of the data packets, not the source? But it seems like DNAT in IPFire is doing exactly that — or is this behavior caused by a configuration error? 
| Configuration: | - red zone - | - orange zone - | ||
|---|---|---|---|---|
| → [Server 1] | ||||
| (Internet) | → [Router: NAT] | → [IPFire: red → DNAT → IP in orange] | → [reverse proxy] | → [Server 2] |
| → [Server 3] |
Does anyone have an idea what the “RED to ORANGE” rule should look like so that the server’s Fail2ban adds the source IP addresses to the blocklist instead of the IP address of the reverse proxy server?
Kind regards,
Thomas