Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to configure fail2ban, I attempted to log into my web server numerous times to trigger the rule and looking at my iptables it seems to have worked:

Chain fail2ban-apache (1 references)
target     prot opt source               destination
DROP       all  --  192.168.1.70         0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

But if I try and access the Apache server from .70 I still can!

Any ideas?

Full list as requested:

Chain INPUT (policy ACCEPT 100998 packets, 137858737 bytes)
     pkts      bytes target        prot opt in     out     source         destination

       0        0 fail2ban-apache  tcp  --  *      *       0.0.0.0/0      0.0.0.0/0            multiport dports 80,443
    1925   322694 fail2ban-ssh     tcp  --  *      *       0.0.0.0/0      0.0.0.0/0            multiport dports 22

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source             destination

Chain OUTPUT (policy ACCEPT 43963 packets, 7223477 bytes)
    pkts      bytes target     prot opt in     out     source             destination

Chain fail2ban-apache (1 references)
    pkts      bytes target     prot opt in     out     source             destination

       0        0 DROP       all  --  *      *       192.168.1.70         0.0.0.0/0
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain fail2ban-ssh (1 references)
    pkts      bytes target     prot opt in     out     source             destination

    1925   322694 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
share|improve this question
1  
What do the rest of your rules look like? Show the whole output from iptables -L -nvx. –  Ladadadada Oct 30 '12 at 15:24

2 Answers 2

up vote 1 down vote accepted

What has happened here is that after attempting to SSH in several times, the fail2ban rule has added 192.168.1.70 to the fail2ban-apache chain, but this chain is only followed for ports 80 and 443. Port 22 is still allowed because 192.168.1.70 has not been added to the fail2ban-ssh chain.

You would find that you can't make http or https requests from your web server from 192.168.1.70 but you can still SSH.

You will probably want to change the fail2ban action for the SSH rule to block SSH rather than http and https.

share|improve this answer
    
Hi, I think I need to clarify some points. I have apache hosted on a port 9000, it was that which I tried to log into and failed, triggering the rule. SSH doesn't come into play here, i'm solely experiencing the issue with apache not blocking. –  Karl Stoney Oct 30 '12 at 16:11
    
There's nothing in your iptables that references port 9000 at all, so traffic on this port will fall through to the POLICY which is ACCEPT in all cases. With that information, it seems that the correct thing to do would be to change the fail2ban-apache rule to act on port 9000 rather than 80 and 443. –  Ladadadada Oct 30 '12 at 16:16
    
Ahh so obvious. Forgive my idiocy i'm new to linux –  Karl Stoney Oct 30 '12 at 16:20
    
Meh, I configured fail2ban-apache rule but it still gives me the same iptable Chain fail2ban-apache (1 references) target prot opt source destination DROP all -- 192.168.1.70 anywhere RETURN all -- anywhere anywhere –  Karl Stoney Oct 30 '12 at 16:22
    
Again, idiocy, edited the wrong file. working beautifully now! many thanks –  Karl Stoney Oct 30 '12 at 16:23

One of the rules with higher presidence is allowing the communication before the firewall gets to your block rule. Block rules should come first, or very close to first, in your rules.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.