Using FirewallD and Fail2Ban on Debian 13

Let’s talk about hardening your Smartermail in Linux. When you put a powerful mail server like SmarterMail on a dedicated Debian box, it’s like opening a high-end storefront. Within minutes, “window shoppers” (automated bots) will start trying every door and window to see if they are locked.

By default, SmarterMail tries to handle these intruders itself. But every time it has to say “No” to a bot, it uses your server’s memory and CPU power. We can stop this by setting up a Digital Bouncer that blocks these “Bad Players” before they even reach your mail software.

The Two-Part Defense System and History of the Gatekeepers

1. FirewallD (The Gatekeeper)

FirewallD was primarily developed by Red Hat engineers, with Thomas Woerner being its lead developer and maintainer. It was first introduced around 2011 to replace the older, more static iptables service. The goal was to provide a “dynamic” firewall manager that could handle changes to network settings, like moving a laptop from home Wi-Fi to a public hotspot, without requiring a full service restart, which would disconnect all active users. Today, it has become the standard firewall management tool for many major Linux distributions, including Fedora, CentOS, and RHEL, and is a popular choice for Debian users who want a robust, zone-based defense.

Think of FirewallD as the physical perimeter fence. By default, it blocks every single “port” (entrance) to your server except for the ones you explicitly leave open for your email and web traffic.

2. Fail2Ban (The Bouncer)

Fail2Ban was originally created by Cyril Jaquier in 2004. It began as a Python-based project designed to solve a very specific, growing problem: the constant barrage of brute-force password guesses against SSH servers. Over the last two decades, it has evolved into a global open-source project maintained by a dedicated community of developers, including long-time maintainer Yaroslav Halchenko. Its genius lies in its simplicity; by bridging the gap between system logs (which record the attacks) and the firewall (which stops the attacks), Fail2Ban has become the most widely used automated “bouncer” in the Linux ecosystem.

Fail2Ban is the intelligence. It sits in the security booth and reads your server’s logs. If it sees the same IP address failing to log in three times or looking for files that don’t exist (like WordPress files on a mail server), it tells the Gatekeeper (FirewallD) to blocklist that IP for 24 hours.

The Installation and Setup Guide

Phase 1: Install the Tools

First, we need to install the software. Open your terminal as root and run:

apt update && apt install firewalld fail2ban ipset -y

Phase 2: Configure the Gatekeeper (FirewallD)

We need to tell the firewall which “doors” to leave open for your mail users.

# Allow standard Mail and Web ports
firewall-cmd --permanent --add-service={http,https,smtp,smtps,submission,imap,imaps,pop3,pop3s}

# If you use SmarterMail's XMPP or other protocols, add those too
firewall-cmd --permanent --add-port=5222/tcp

# Before reloading, ensure SSH is allowed so you don't lock yourself out!
firewall-cmd --permanent --add-service=ssh

# Apply the changes
firewall-cmd --reload

Phase 3: Teach the Bouncer what to look for

We need to create a “Filter” that understands SmarterMail’s specific log language.

1. Create the filter file: nano /etc/fail2ban/filter.d/smartermail.conf
2. Paste this exact text in:

[Definition]
# This catches SMTP login failures and common web-probes (like xmlrpc)
failregex = ^.* \[<HOST>\].*Authentication failed - login failed.*$
            ^.* \[<HOST>\].*GET .*(?:xmlrpc|wp-admin|wp-login|\.env).* 404$
            ^.* \[<HOST>\].*POST .*(?:xmlrpc|wp-admin|wp-login).* 404$
ignoreregex =

Phase 4: Create the “Jail” (The Rules)

Now we tell Fail2Ban which logs to watch and how long to punish the offenders.

1. Create the jail file: nano /etc/fail2ban/jail.local
2. Paste this in:

[smartermail]
enabled = true
port = 25,465,587,993,995,143,110,80,443,5222
filter = smartermail
# This watches every log SmarterMail creates
logpath = /var/lib/smartermail/Logs/*.log
maxretry = 3
findtime = 10m
bantime = 24h
action = firewallcmd-ipset
backend = auto

Final Steps: Activation

To start the system, run these commands:

# Start and enable the services
systemctl enable --now firewalld
systemctl enable --now fail2ban

How to Check Your “Wall of Shame”

To see if your bouncer has caught anyone yet, run this command:

fail2ban-client status smartermail

To see the actual list of blocked IP addresses currently held by the Linux kernel:

ipset list f2b-smartermail

Summary for the Admin

By following this process, you shift the burden of security from your SmarterMail software to the Linux Kernel. This typically results in a 20-30% reduction in CPU usage and protects your server from the wear and tear of thousands of useless automated attacks. Your server is now no longer just “running”, it’s “defending.”