I installed fail2ban with nginx and it's working untill i moved it behind load balancer. Bcoz after moving behind load balancer i found there is 2 IP's showing in Logs.I want that fail2ban detect first IP and block it according to the rule. The following is a sample log entry:
126.96.36.199, 188.8.131.52 - - [08/Jul/2020:10:55:08 +0530] "GET /telangana/%E0%B0%B0%E0%B0%BE%E0%B0%B7%E0%B1%8D%E0%B0%9F%E0%B1%8D%E0%B0%B0%E0%B0%82%E0%B0%B2%E0%B1%8B-%E0%B0%85%E0%B0%A6%E0%B1%8D%E0%B0%AD%E0%B1%81%E0%B0%A4%E0%B0%AE%E0%B1%88%E0%B0%A8-%E0%B0%AE%E0%B0%BE%E0%B0%B0/ HTTP/1.1" 200 18082 "-" "Amazon CloudFront"
My fail2ban filter is :
[Definition] failregex = <HOST> - - .*(POST|GET) .* HTTP.* 403 .*$ ignoreregex =
And My fail2ban jail is :
[httpd-forbidden] enabled = true filter = httpd-forbidden logpath = /var/log/nginx/example.com_custom.access.log bantime = 1800 findtime = 300 maxretry = 50 port = 80,443 banaction = iptables-multiport
Please help to correct fail2ban regex.