Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks. Received: from localhost.localdomain (sposting.com [**REAL IP HERE**]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UT…

Derp. Thanks. That won’t prevent the IP from leaking via Mailgun though, will it? I think I might be limited to Mailgun API only. No idea how I’m going to integrate that if so.

Mailgun is a separate problem, but you’ve got to close off every avenue of leakage if you want to remain DDoS proof.

[immagine] anon67292109: Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse I warned you for that: [immagine] [PAYING GIG] migrating servers, tweaking rate limits and implementing signup captcha Make sure your outgoing emails don’t leak the original IP address …

[immagine] anon67292109: I think I might be limited to Mailgun API only. If you did a standard install , you’re delivering mail via SMTP, not the API.

[immagine] michaeld: See this article: https://major.io/p/remove-sensitive-information-from-email-headers-with-postfix/ Going to try to implement this. I’ll let you know how I make out ITT. [immagine] pfaffman: If you did a standard install , you’re delivering mail via SMTP, not the API. …

Yeah. The relay server is the cleaner of those solutions. You could offer a bounty for someone to write a send-with-mailgun-api plugin. I have no idea how hard it’d be, but there are hooks to use mailgun webhooks.

Solved. The quick and dirty solution was indeed a mail relay server. I set up a cheap $5/mo DigitalOcean droplet running Postfix as a Mailgun relay and a custom header_checks file to prevent the original requesting IP, i.e. my Discourse droplet, from being displayed in the email headers. Discourse …

Just for curiosity I checked what Mandrill does, and yes it leaks my server IP address too. So if I were concerned hiding the original IP gainst DOS, I would setup a mailrelay .

For those who are looking at this today, someone who wants to DDOS you can drop anything that discourse tries to fetch, point the url of the file to a server they control and get your IP address. Relay for the mail server isn’t enough, you need a rule to send new outbound connections from discourse …

You could also use firewall rules to disable all connections except from cloudflare.

Mailgun leaking server's real IP behind Cloudflare

Support

pfaffman (Jay Pfaffman) 16 Maggio 2019, 3:20pm 21

Oh. Right. I totally forgot spoofing the source IP address for a DDOS attack.

Reverse proxy for Discourse | Real IP masking

Argomento		Risposte	Visualizzazioni
How to solve the problem of source IP leakage and DD attacks even when using Cloudflare CDN? Support	10	503	Settembre 15, 2024
Possibility to transport emails via API Support	3	883	Dicembre 3, 2017
Configure Mailgun for email when using Digital Ocean for DNS Sysadmins email , how-to	28	15353	Ottobre 14, 2020
Proposed changes to discourse-setup because Digital Ocean blocks outbound smtp Development	28	3135	Giugno 9, 2025
Looks like DO is disabling Smtp in their Discourse hosting plans Self-hosting hosting	25	911	Agosto 20, 2024

Mailgun leaking server's real IP behind Cloudflare

Argomenti correlati