Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have just installed Fail2Ban.

I want to add my ISP IP to my ignore list but my IP is dynamic.

In the jail.conf file, I have like this:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1
bantime  = 600
maxretry = 3

My DNS look something like this: 12-123-112-223.zone6.myISPName.co.uk

Is it possible to add DNS wild to the ignore list? eg, *.myISPName.co.uk

share|improve this question
1  
I don't see why you would need to do this. Connections within your computer will have a source address of 127.0.0.1. Make sure you aren't banning the destination address. –  BillThor Mar 10 '12 at 18:32
add comment

2 Answers

up vote 4 down vote accepted

fail2ban don't allow you to use wildcard addresses.
You have several possibilities :
1. use a dynamic DNS for the address you want to exclude
2. write an accept rule for iptable, executed prior to fail2ban rules
3. just configure fail2ban

How to configure fail2ban to ignore your address ?
Inside /etc/fail2ban/filter.d/ you have pre-made filters. Your rule(s) already use one of them (for example with filter = sshd use the sshd filter).
Just modify the filter(s) you want (or modify a copy) to add an "exclude" rule.
The exclude rules start with ignoreregex. They are written exactly as the "match" rules. Have a look at man fail2ban-regex.
For your example you can just add ignoreregex .myISPName.co.uk in the desired filter.
But this will also protect any attacker from the same ISP.

share|improve this answer
    
In contrast to the OP's jail.config, mine says ignoreip = 127.0.0.1/8. <-- Do you know what that / (slash) is there for? Is it perhaps a range between 1–8, no? If so, maybe it's possible to enter the first static numbers and put the dynamic numbers between 1/255 … I may be totally out in the blue here, though. :) –  hced Apr 22 '12 at 20:04
1  
/8 means the number of bits set to 1 in the netmask. So /8 means 255.0.0.0 and /24 mean 255.255.255.0 –  Gregory MOUSSAT Apr 22 '12 at 21:14
add comment

create a simple script in /usr/local/bin/userip

#!/bin/sh
if [ ! -z $1 ]; then
    who --ips | grep ^$1 | rev | cut -d' ' -f1 | rev | tail -n1
fi

That Get ip address of logged username passed in first argument

Edit /etc/fail2ban/action.d/iptables-multiport.conf (or iptables.conf)

actionban = [ ''$(userip YOURUSER) != '<ip>' ] && iptables -I fail2ban-<name> 1 -s <ip> -j DROP

now fail2ban not block your ip address until you are logged with your username YOURUSER with ssh

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.