Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks. Received: from localhost.localdomain (sposting.com [**REAL IP HERE**]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UT…

Derp. Thanks. That won’t prevent the IP from leaking via Mailgun though, will it? I think I might be limited to Mailgun API only. No idea how I’m going to integrate that if so.

Mailgun is a separate problem, but you’ve got to close off every avenue of leakage if you want to remain DDoS proof.

[imagem] anon67292109: Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse I warned you for that: [imagem] [PAYING GIG] migrating servers, tweaking rate limits and implementing signup captcha Make sure your outgoing emails don’t leak the original IP address I…

[imagem] anon67292109: I think I might be limited to Mailgun API only. If you did a standard install , you’re delivering mail via SMTP, not the API.

[imagem] michaeld: See this article: https://major.io/p/remove-sensitive-information-from-email-headers-with-postfix/ Going to try to implement this. I’ll let you know how I make out ITT. [imagem] pfaffman: If you did a standard install , you’re delivering mail via SMTP, not the API. Y…

Yeah. The relay server is the cleaner of those solutions. You could offer a bounty for someone to write a send-with-mailgun-api plugin. I have no idea how hard it’d be, but there are hooks to use mailgun webhooks.

Solved. The quick and dirty solution was indeed a mail relay server. I set up a cheap $5/mo DigitalOcean droplet running Postfix as a Mailgun relay and a custom header_checks file to prevent the original requesting IP, i.e. my Discourse droplet, from being displayed in the email headers. Discourse …

Just for curiosity I checked what Mandrill does, and yes it leaks my server IP address too. So if I were concerned hiding the original IP gainst DOS, I would setup a mailrelay .

For those who are looking at this today, someone who wants to DDOS you can drop anything that discourse tries to fetch, point the url of the file to a server they control and get your IP address. Relay for the mail server isn’t enough, you need a rule to send new outbound connections from discourse …

You could also use firewall rules to disable all connections except from cloudflare.

Mailgun leaking server's real IP behind Cloudflare

Support

pfaffman (Jay Pfaffman) 16 Maio , 2019 15:20 21

Oh. Right. I totally forgot spoofing the source IP address for a DDOS attack.

Reverse proxy for Discourse | Real IP masking

Tópico		Respostas	Vistas
How to solve the problem of source IP leakage and DD attacks even when using Cloudflare CDN? Support	10	494	15 Setembro , 2024
Possibility to transport emails via API Support	3	881	3 Dezembro , 2017
Configure Mailgun for email when using Digital Ocean for DNS Sysadmins email , how-to	28	15342	14 Outubro , 2020
Proposed changes to discourse-setup because Digital Ocean blocks outbound smtp Development	28	3128	9 Junho , 2025
Looks like DO is disabling Smtp in their Discourse hosting plans Self-hosting hosting	25	904	20 Agosto , 2024

Mailgun leaking server's real IP behind Cloudflare

Related topics