Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just noticed that fail2ban reports it 'banned' an IP address doing the following:


183.60.48.25 - - [03/Jul/2013:10:14:26 -0700] "GET http://www.baidu.com/ HTTP/1.1" 200 5112
183.60.48.25 - - [03/Jul/2013:14:29:37 -0700] "CONNECT tcpconn2.tencent.com:443 HTTP/1.1" 200 5112

fail2ban reported it dropped (with no errors in fail2ban log file):


2013-07-03 23:40:29,335 fail2ban.actions: WARNING [php-errs] Ban 183.60.48.25

yet this IP continues to log the same entries NOTE: I added my own iptables DROP and apache is STILL saying status 200 on these, whats going on?


iptables -L | grep "183.60.48.25"
DROP       all  --  183.60.48.25         anywhere
REJECT all -- 183.60.48.25 anywhere reject-with icmp-port-unreachable REJECT all -- 183.60.48.25 anywhere reject-with icmp-port-unreachable

share|improve this question
    
yes, I have: $IPTABLES -A INPUT -i $ETH0 -s $ANY -d $SERVER -p tcp --dport http -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT $IPTABLES -A INPUT -i $ETH0 -s $ANY -d $SERVER -p tcp --sport http -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT –  Tim Jul 4 '13 at 20:01
    
conntrack -L | grep 183 showed: conntrack v1.4.0 (conntrack-tools): tcp 6 115240 ESTABLISHED src=192.168.1.22 dst=183.60.48.25 sport=8080 dport=39288 [UNREPLIED] src=183.60.48.25 dst=192.168.1.22 sport=39288 dport=8080 mark=0 use=1 28 flow entries have been shown. –  Tim Jul 4 '13 at 20:21
    
Opps, hit return too soon. Then I tried to delete: conntrack -D -s 183.60.48.25 conntrack v1.4.0 (conntrack-tools): 0 flow entries have been deleted. Then iptables-save | grep 183 showed: -A INPUT -s 183.60.48.25/32 -j DROP -A fail2ban-php-err-jeff -s 183.60.48.25/32 -j REJECT --reject-with icmp-port-unreachable -A fail2ban-php-jeff -s 183.60.48.25/32 -j REJECT --reject-with icmp-port-unreachable I expected conntrack -D -s to say it dropped it. Im new to conntrack and fail2ban as well. –  Tim Jul 4 '13 at 20:23
    
Thanks for the explanations. Does fail2ban have any option to use conntrack to delete it from its ESTABLISHED tables? Maybe it should be a feature to add in a future version (or maybe I should hack it to do that for now?) –  Tim Jul 4 '13 at 21:02
    
that was a workaround. you need to find out if the fail2ban chains are operative in your iptables config. Then test the regex. –  dawud Jul 4 '13 at 21:32
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.