Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse which is resulting in repeated DDoS attacks. Received: from localhost.localdomain (sposting.com [**REAL IP HERE**]) by mxa.mailgun.org with ESMTP id 78c1220.7fe02c20b530-smtp-out-n03; Wed, 15 Mar 2017 01:30:08 -0000 (UT…

Derp. Thanks. That won’t prevent the IP from leaking via Mailgun though, will it? I think I might be limited to Mailgun API only. No idea how I’m going to integrate that if so.

Mailgun is a separate problem, but you’ve got to close off every avenue of leakage if you want to remain DDoS proof.

[תמונה] anon67292109: Mailgun is leaking my DigitalOcean server IPs via emails deployed for Discourse I warned you for that: [תמונה] [PAYING GIG] migrating servers, tweaking rate limits and implementing signup captcha Make sure your outgoing emails don’t leak the original IP address I …

[תמונה] anon67292109: I think I might be limited to Mailgun API only. If you did a standard install , you’re delivering mail via SMTP, not the API.

[תמונה] michaeld: See this article: https://major.io/p/remove-sensitive-information-from-email-headers-with-postfix/ Going to try to implement this. I’ll let you know how I make out ITT. [תמונה] pfaffman: If you did a standard install , you’re delivering mail via SMTP, not the API. Yes…

Yeah. The relay server is the cleaner of those solutions. You could offer a bounty for someone to write a send-with-mailgun-api plugin. I have no idea how hard it’d be, but there are hooks to use mailgun webhooks.

Solved. The quick and dirty solution was indeed a mail relay server. I set up a cheap $5/mo DigitalOcean droplet running Postfix as a Mailgun relay and a custom header_checks file to prevent the original requesting IP, i.e. my Discourse droplet, from being displayed in the email headers. Discourse …

Just for curiosity I checked what Mandrill does, and yes it leaks my server IP address too. So if I were concerned hiding the original IP gainst DOS, I would setup a mailrelay .

For those who are looking at this today, someone who wants to DDOS you can drop anything that discourse tries to fetch, point the url of the file to a server they control and get your IP address. Relay for the mail server isn’t enough, you need a rule to send new outbound connections from discourse …

You could also use firewall rules to disable all connections except from cloudflare.

Mailgun leaking server's real IP behind Cloudflare

תמיכה

pfaffman (Jay Pfaffman) 16 במאי,‏ 2019,‏ 3:20pm 21

Oh. Right. I totally forgot spoofing the source IP address for a DDOS attack.

Reverse proxy for Discourse | Real IP masking

נושא		תגובות	צפיות
How to solve the problem of source IP leakage and DD attacks even when using Cloudflare CDN? Support	10	405	15 בספטמבר,‏ 2024
Possibility to transport emails via API Support	3	872	3 בדצמבר,‏ 2017
Configure Mailgun for email when using Digital Ocean for DNS Sysadmins email , how-to	28	15233	14 באוקטובר,‏ 2020
Proposed changes to discourse-setup because Digital Ocean blocks outbound smtp Development	28	3052	9 ביוני,‏ 2025
Looks like DO is disabling Smtp in their Discourse hosting plans Self-hosting hosting	25	862	20 באוגוסט,‏ 2024

Mailgun leaking server's real IP behind Cloudflare

נושאים קשורים