Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks. Received: from localhost.localdomain (sposting.com [**REAL IP HERE**]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UT…

Derp. Thanks. That won’t prevent the IP from leaking via Mailgun though, will it? I think I might be limited to Mailgun API only. No idea how I’m going to integrate that if so.

Mailgun is a separate problem, but you’ve got to close off every avenue of leakage if you want to remain DDoS proof.

[图片] anon67292109: Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse I warned you for that: [图片] [PAYING GIG] migrating servers, tweaking rate limits and implementing signup captcha Make sure your outgoing emails don’t leak the original IP address I don’t …

[图片] anon67292109: I think I might be limited to Mailgun API only. If you did a standard install , you’re delivering mail via SMTP, not the API.

[图片] michaeld: See this article: https://major.io/p/remove-sensitive-information-from-email-headers-with-postfix/ Going to try to implement this. I’ll let you know how I make out ITT. [图片] pfaffman: If you did a standard install , you’re delivering mail via SMTP, not the API. Yes natur…

Yeah. The relay server is the cleaner of those solutions. You could offer a bounty for someone to write a send-with-mailgun-api plugin. I have no idea how hard it’d be, but there are hooks to use mailgun webhooks.

Solved. The quick and dirty solution was indeed a mail relay server. I set up a cheap $5/mo DigitalOcean droplet running Postfix as a Mailgun relay and a custom header_checks file to prevent the original requesting IP, i.e. my Discourse droplet, from being displayed in the email headers. Discourse …

Just for curiosity I checked what Mandrill does, and yes it leaks my server IP address too. So if I were concerned hiding the original IP gainst DOS, I would setup a mailrelay .

For those who are looking at this today, someone who wants to DDOS you can drop anything that discourse tries to fetch, point the url of the file to a server they control and get your IP address. Relay for the mail server isn’t enough, you need a rule to send new outbound connections from discourse …

You could also use firewall rules to disable all connections except from cloudflare.

Mailgun leaking server's real IP behind Cloudflare

支持

pfaffman (Jay Pfaffman) 2019 年5 月 16 日 15:20 21

Oh. Right. I totally forgot spoofing the source IP address for a DDOS attack.

Reverse proxy for Discourse | Real IP masking

话题		回复	浏览量
How to solve the problem of source IP leakage and DD attacks even when using Cloudflare CDN? Support	10	430	2024 年9 月 15 日
Possibility to transport emails via API Support	3	879	2017 年12 月 3 日
Configure Mailgun for email when using Digital Ocean for DNS Sysadmins email , how-to	28	15256	2020 年10 月 14 日
Proposed changes to discourse-setup because Digital Ocean blocks outbound smtp Development	28	3083	2025 年6 月 9 日
Looks like DO is disabling Smtp in their Discourse hosting plans Self-hosting hosting	25	871	2024 年8 月 20 日

Mailgun leaking server's real IP behind Cloudflare

相关话题