Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just noticed that fail2ban reports it 'banned' an IP address doing the following: - - [03/Jul/2013:10:14:26 -0700] "GET HTTP/1.1" 200 5112 - - [03/Jul/2013:14:29:37 -0700] "CONNECT HTTP/1.1" 200 5112

fail2ban reported it dropped (with no errors in fail2ban log file):

2013-07-03 23:40:29,335 fail2ban.actions: WARNING [php-errs] Ban

yet this IP continues to log the same entries NOTE: I added my own iptables DROP and apache is STILL saying status 200 on these, whats going on?

iptables -L | grep ""
DROP       all  --         anywhere
REJECT all -- anywhere reject-with icmp-port-unreachable REJECT all -- anywhere reject-with icmp-port-unreachable

share|improve this question
yes, I have: $IPTABLES -A INPUT -i $ETH0 -s $ANY -d $SERVER -p tcp --dport http -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT $IPTABLES -A INPUT -i $ETH0 -s $ANY -d $SERVER -p tcp --sport http -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT – Tim Jul 4 '13 at 20:01
conntrack -L | grep 183 showed: conntrack v1.4.0 (conntrack-tools): tcp 6 115240 ESTABLISHED src= dst= sport=8080 dport=39288 [UNREPLIED] src= dst= sport=39288 dport=8080 mark=0 use=1 28 flow entries have been shown. – Tim Jul 4 '13 at 20:21
Opps, hit return too soon. Then I tried to delete: conntrack -D -s conntrack v1.4.0 (conntrack-tools): 0 flow entries have been deleted. Then iptables-save | grep 183 showed: -A INPUT -s -j DROP -A fail2ban-php-err-jeff -s -j REJECT --reject-with icmp-port-unreachable -A fail2ban-php-jeff -s -j REJECT --reject-with icmp-port-unreachable I expected conntrack -D -s to say it dropped it. Im new to conntrack and fail2ban as well. – Tim Jul 4 '13 at 20:23
Thanks for the explanations. Does fail2ban have any option to use conntrack to delete it from its ESTABLISHED tables? Maybe it should be a feature to add in a future version (or maybe I should hack it to do that for now?) – Tim Jul 4 '13 at 21:02
that was a workaround. you need to find out if the fail2ban chains are operative in your iptables config. Then test the regex. – dawud Jul 4 '13 at 21:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.