Is there a way to restrict a fail2ban rule to only set of IP ranges? This would basically be the opposite of the ignoreip config.
We're experiencing intermittent (~2 hours a day, usually in the morning) bursts of Apache traffic from random IPs in AWS us-west-2 and I've built a fail2ban filter that will catch it, but the problem is we are sweeping up legitimate traffic with these. We've had to disable the filter after ~48 hours because no matter what settings we use, legitimate users are getting blocked. If we could restrict the filter to us-west-2 IPs, which is easy enough to get, it should function the way we need it to.
We're unable to block us-west-2 altogether because this server receives legitimate traffic from some IPs there, though that list of IPs changes regularly without any kind of warning.
This is fail2ban 0.8.6, so it is a outdated. I should be able to update if a solution calls for it.
