0

Is there a way to restrict a fail2ban rule to only set of IP ranges? This would basically be the opposite of the ignoreip config.

We're experiencing intermittent (~2 hours a day, usually in the morning) bursts of Apache traffic from random IPs in AWS us-west-2 and I've built a fail2ban filter that will catch it, but the problem is we are sweeping up legitimate traffic with these. We've had to disable the filter after ~48 hours because no matter what settings we use, legitimate users are getting blocked. If we could restrict the filter to us-west-2 IPs, which is easy enough to get, it should function the way we need it to.

We're unable to block us-west-2 altogether because this server receives legitimate traffic from some IPs there, though that list of IPs changes regularly without any kind of warning.

This is fail2ban 0.8.6, so it is a outdated. I should be able to update if a solution calls for it.

1 Answer 1

0

You can configure fail2ban's base chain. So

  1. create a new chain
  2. make that the base chain
  3. send only the respective traffic (those addresses you want checked) from INPUT to that chain

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.