Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?

share|improve this question

closed as not a real question by Scott Pack, HopelessN00b, squillman, Jeff Ferland, Dave M Aug 24 '12 at 19:26

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 12 down vote accepted

Start with below

New filter in /etc/fail2ban/nginx-dos.conf:

# Fail2Ban configuration file
# Generated on Fri Jun 08 12:09:15 EST 2012 by BeezNest
# Author: Yannick Warnir
# $Revision: 1 $

# Option:  failregex
# Notes.:  Regexp to catch a generic call from an IP address.
# Values:  TEXT
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
ignoreregex =

In our jail.local, we have (at the end of the file):

# Based on apache-badbots but a simple IP check (any IP requesting more than
# 240 pages in 60 seconds, or 4p/s average, is suspicious)
# Block for two full days.
# @author Yannick Warnier
enabled = true
port    = http,8090
filter  = nginx-dos
logpath = /var/log/nginx/*-access.log
findtime = 60
bantime  = 172800
maxretry = 240

Of course, in case you would be logging all resources of your site (images, css, js, etc), it would be really easy to get to those numbers as a normal user. To avoid this, use the access_log off directive of Nginx, like so:

 # Serve static files directly
        location ~* \.(png|jpe?g|gif|ico)$ {
                expires 1y;
                access_log off;
                try_files $uri $uri/ @rewrite;
                gzip off;
        location ~* \.(mp3)$ {
                expires 1y;
                access_log off;
                gzip off;
        location ~* \.(css)$ {
                expires 1d;
                access_log off;
        location ~* \.(js)$ {
                expires 1h;
                access_log off;
share|improve this answer
nginx-dos.conf should be in filter.d folder right? – THpubs Aug 25 '12 at 9:59
late response but for anyone else that sees this... yes in filter.d – iDev247 Apr 14 '14 at 4:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.