0

Fail2ban doesn't seem to block permanently.

I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Why is this happening if i set it to -1, is there something else i need to configure?

2
  • I'm not familiar with fail2ban but it seems it just adds rules to iptables. It's not reboot-resistant
    – mveroone
    Aug 27, 2013 at 15:07
  • Yeah but i havent rebooted my computer since which is weird.
    – soniccool
    Aug 27, 2013 at 15:09

1 Answer 1

1

Fail2ban doesn't have a feature to permanently block.

See http://www.fail2ban.org/wiki/index.php/Fail2ban%3aCommunity_Portal#Permanently_Ban_Persistent_IP_Addresses and http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban for more information.

4
  • So why does it say -1 in the config will make it permanent
    – soniccool
    Aug 27, 2013 at 15:07
  • @soniccool That depends on the version of fail2ban. Setting a nice long expiry time - like a year - is the usual solution. Alternatively, store "permabans" in a separate file/iptables rule.
    – voretaq7
    Aug 27, 2013 at 15:52
  • Got it alright! I guess a year will do haha
    – soniccool
    Aug 27, 2013 at 15:53
  • If you're happy with my solution you're able to upvote or choose this answer as being the most correct/useful one. Feb 15, 2014 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .