Securing a Server Cluster With ReportedIP: Agent, Groups and DNSBL
To secure a server cluster with ReportedIP, run the ReportedIP Linux Agent on every Linux node and put their API keys into one group: each node then keeps the community blacklist in its kernel firewall and drops any address another node reported. Mail relays can add the DNS / RBL Zone inside SMTP, and hosts that cannot run the agent pull the same data as a feed or over the API.
When this article first appeared in May 2026, a DNS zone was the only shared layer for a whole cluster. Since September 2026 the agent and groups cover most of the nodes, and the zone stays the right tool for mail filters and appliances.
Which ReportedIP building block fits each tier of a cluster?
A cluster rarely runs one kind of machine. The table maps the usual tiers to the part of ReportedIP that fits them. All of them read from one community database of scored attacker addresses.
| Cluster tier | What protects it | How it reads the data |
|---|---|---|
| Linux web, app and database hosts | Linux Agent | Kernel sets |
| Mail relays | Linux Agent and DNS / RBL Zone | Kernel sets and DNSBL lookups |
| WordPress front ends | Hive plugin | Local blocks and the group list |
| Appliances and cloud firewalls | Blacklist feed | Scheduled export |
| Application and API backends | REST API | Score check per request |
| Decoy nodes | Honeypot Server | Reports only |
Because every tier reads the same scores, an attacker that a honeypot or a WordPress site reported is dropped at your edge and at your mail relays once its score qualifies. Reporting back what your own nodes see is what keeps that shared data accurate for everyone.
How does the Linux Agent protect each node?
The agent is a single static binary for linux/amd64 and linux/arm64, at version 0.3.38 as of September 28, 2026. It does three jobs on each host:
- It loads the community blacklist into ipset or nftables as five lists, one per exposed service: ssh, mail, web, ftp and edge. Each list matches only the ports of its service, so an entry on the web list never touches SSH.
- It reads the logs the host already writes, fourteen source types from sshd to Postfix, Dovecot and the web server, and reports an address once it crosses the threshold of that source. No log line, user name or URL leaves the machine.
- It blocks what it found itself, with a timeout that grows for repeat offenders. A host that should only report can switch local blocking off.
On a licensed server the feed is refreshed every 15 minutes from Professional upwards. Without a licence only the feed download pauses: the list already in the kernel stays, and detection, local blocking and reports keep running. The agent replaces the hand-written sync script and takes over from fail2ban; requirements and the quick install are in the Linux Agent docs.
Each server needs a licence, counted per install
Server licences are a pool of their own, counted separately from Hive domains. A host is identified by the random install ID the agent creates, never by its hostname or its key, so rotating a key or renaming a machine does not use a second licence. When an account has more agents than licences, the oldest hosts keep theirs.
| Plan | Servers included | Groups | Keys per group |
|---|---|---|---|
| Professional | 1 | 1 | 10 |
| Business | 3 | 3 | 50 |
| Enterprise | By contract | 100 | 500 |
Each additional server costs 4.90 € a month incl. VAT, falling to 1.40 € from 50 licences; the full scale is on the server licences page. Free and Contributor accounts can run the agent as a reporter with full local blocking, but they cannot book a licence or create a group.
How do you share one ban across every node?
Put the API keys of your nodes into one group in your reportedip.com account. When one member reports an address, every other member blocks it for the group’s ban window, 24 hours by default, on every port. The agent keeps that list in a sixth kernel set named group. WordPress sites running Hive can join the same group and mirror the list as a block type of their own.
Two details matter in a cluster. A member’s own reporting address is never on the list it receives, so a group cannot lock your nodes out of each other. And a group can carry a whitelist of up to 200 addresses and prefixes for monitoring and management hosts that must never be blocked anywhere. Each new ban can also trigger a signed webhook to a chat or ticket system, described in the Groups docs. The setup in four steps, with example output, is in Share IP bans across Linux servers.
When is the DNS / RBL Zone the better fit?
The agent drops a listed address in the kernel before it reaches Postfix. Many mail setups want the decision inside the SMTP dialogue instead: reject with a reason, or add a score in Rspamd and still accept the message. That is what the DNS / RBL Zone does. It serves the community blacklist as a keyed DNSBL at bl.reportedip.de and follows RFC 5782 for IPv4 and IPv6. It also fits machines where you cannot run a root daemon, such as a managed mail gateway or a spam appliance that accepts any RBL.
A listed address answers 127.0.0.2 at confidence 90 or above and 127.0.0.3 between 75 and 89; a clean address answers NXDOMAIN. In Postfix it is one restriction, identical on every mail node:
# main.cf (same on every mail node)
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_rbl_client <your-token>.bl.reportedip.de=127.0.0.[2..3]
# keep the token out of bounces and logs:
rbl_reply_maps = texthash:/etc/postfix/rbl_replyThe reply override that keeps the token out of SMTP bounces is spelled out in the docs. Category sub-zones such as brute-force or spam narrow the answer to one threat type, so a mail tier can weight spam differently from login attacks.
One zone key for the cluster, or one per mail server
Each key comes with 100,000 lookups per day, reset at 00:00 UTC, and a rate limit of about 50 queries per second. Usage counts per key, whichever node sends it: node A with 40,000 lookups and node B with 35,000 count as 75,000. Resolver caching keeps most repeat lookups inside your network, 30 minutes for a listing and 5 minutes for NXDOMAIN.
A small cluster can share one key. For busy relays, one key per mail server is the cleaner split: one node cannot exhaust the others, and a leaked key is rotated without touching the rest. Each key is its own subscription at 7.90 € a month or 79 € a year incl. VAT, bookable from Professional.
What about hosts that cannot run the agent?
Cloud firewalls, load balancers and non-Linux machines take the blacklist feed: the same data as a text, JSON or CSV export, filtered by confidence and category and pulled on a schedule. Access starts at the free Contributor tier and does not count against a daily quota. The do-it-yourself route with ipset scripts and fail2ban reporting is covered in Protect your web server; on a Linux host the agent does the same job with less to maintain.
Application and API backends that need a verdict at request time call the REST API. A free account covers 1,000 checks and 50 reports per day, and bulk checks start at Professional.
How do you roll ReportedIP out across a cluster?
- Run
reportedip-agent doctoron one host of each kind. It changes nothing and names anything missing, such as a firewall backend or an unread log. - Whitelist your management and monitoring addresses before the first sync, because the rules drop traffic from that sync on.
- Install unattended with
REPORTEDIP_ACCEPT_TERMS=1andREPORTEDIP_KEYfrom Ansible, cloud-init or a golden image, as shown in the installation examples. - Create a group, add the keys of every node and of any Hive site, and move shared exceptions into the group whitelist.
- Book the DNS / RBL Zone for mail relays and appliances that should decide inside SMTP, and add the restriction on each.
- Put one or two decoy nodes on unused addresses with the Honeypot Server. Their reports raise the score of every attacker they catch across the network.
Questions about securing a server cluster
Does every server in the cluster need its own licence?
Every server that should receive the community feed and the group list needs a licence. Professional includes one and Business three, and more cost from 4.90 € down to 1.40 € per server and month. A server without a licence still detects, blocks locally and reports, so it keeps contributing to the cluster.
Can one DNS / RBL Zone key serve every mail server?
One key can serve every mail server of a small cluster, because its 100,000 daily lookups count per key, whichever node sends them. Busy relays are better split into one key per server, so a single node cannot use up the quota of the others and a leaked key can be rotated on its own.
Should I keep fail2ban next to the agent?
Only for the switch. The agent takes over from fail2ban: check first which tool owns the firewall set names, run both for a while, then switch fail2ban off for good. A host that keeps fail2ban still has its bans reported, because the agent reads fail2ban as one of its sources.