I have a VM with a custom firewall script and Fail2ban.
I've identified some IP ranges that make permanent intrusion attempts so I blocked them directly in my firewall script. Here is a simplified overview:
#!/bin/sh
### BEGIN INIT INFO
# Provides: Custom firewall
# Required-Start: $remote_fs $syslog $network
# Required-Stop: $remote_fs $syslog $network
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short Description: Firewall init script
# Description: Custom firewall
### END INIT INFO
## Lock everything
# Clear current tables
iptables -t filter -F
iptables -t filter -X
# Deny all connexions (input and output)
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
## Common configurations
# Preserve established connexions
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT
# Allow ICMP (ping)
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT
## Custom rules
# SSH
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT
# HTTP
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
## JAIL
iptables -A INPUT -s 61.147.80.0/24 -j DROP
iptables -A INPUT -s 61.167.49.0/24 -j DROP
iptables -A INPUT -s 61.174.50.0/24 -j DROP
iptables -A INPUT -s 61.174.51.0/24 -j DROP
iptables -A INPUT -s 103.41.124.0/24 -j DROP
iptables -A INPUT -s 122.225.97.0/24 -j DROP
iptables -A INPUT -s 122.225.103.0/24 -j DROP
iptables -A INPUT -s 122.225.109.0/24 -j DROP
Fail2ban works like a charm but I'm surprised that it still detects attempts from banned IPs such as 122.225.109.107
since they should be banned with my firewall script. How is this possible ?