CalDAV/CardDAV initial account connect triggers ""Port scanning ban"

Issues
1

Issue Description

Hej,

when connecting a new client to an existing account on CardDAV / CalDAV frequently the initial download of the existing data triggers a ban and blocks IP address.

Easy answer is to increase the limit thresholds - however the limits work just fine once everything is setup and configured and the data is downloaded. And I prefer to keep the bad guys out.

Expected Behavior

Two possible ideas:

  • After successful authentication for CalDAV/CardDAV give 5 minutes of whitelisting IP

OR

  • Have different limits for initial setup of CalDAV/CardDAV connections and after download.

I have no idea how to identify behaviour of the second solution.

Actual Behavior

When deleting my account on Android using DAVx5 and setting it up again, my IP will be blocked and I cannot send emails nor configure the server.

Reproduction Steps

Delete existing CalDAV/CardDAV account on client
Setup again existing account on client
Initiate full sync

Stalwart Version

v0.16.x

Installation Method

Docker

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

There’s an AllowedIp object that permanently or temporarily whitelists an IP from all these ban checks. Let me confirm the docs for this.

This confirms the mechanism to allowlist an IP directly, and also that account.allowedIps exists per-account (for API key/app password restrictions). But the most relevant is the AllowedIp singleton list and per-account allowedIps that “bypass rate limits and auto-banning.”

Now let’s check whether authentication credential (account) has such allowedIps too, since that could restrict CalDAV account specifically.

3

Thank you,

however this does not work with dialup IP address range (e.g. DSL or fibre from home with changing WAN IP addresses) unless I can use a DNS name?

4

To pin down which rule is firing, could you open the blocked entry (Settings > Security > Blocked IPs, or the corresponding security event) and tell me the exact reason, and if it’s portScanning, the Path recorded on the scan-ban event? The standard DAVx5 discovery and sync paths don’t match the scanner-path globs, so my guess is you’re tripping the rate-based scanner counter during the aggressive parallel initial sync rather than a path match, but the logged reason will confirm it.

Either way it’s tunable: the scan-ban rate and period live on the Security settings, so you can raise the rate and set a short period so an accidental ban clears itself. That’s documented at Auto-banning | Stalwart.

On the dynamic-IP question: the allow-list only takes IP addresses or CIDR masks, there’s no hostname or DNS support, so a changing home IP can’t be allow-listed by name. Your options are raising the thresholds, or allow-listing a stable range if your client egresses from one.