2

I installed fail2ban with nginx and it's working untill i moved it behind load balancer. Bcoz after moving behind load balancer i found there is 2 IP's showing in Logs.I want that fail2ban detect first IP and block it according to the rule. The following is a sample log entry:

46.229.168.138, 64.252.86.102 - - [08/Jul/2020:10:55:08 +0530] "GET /telangana/%E0%B0%B0%E0%B0%BE%E0%B0%B7%E0%B1%8D%E0%B0%9F%E0%B1%8D%E0%B0%B0%E0%B0%82%E0%B0%B2%E0%B1%8B-%E0%B0%85%E0%B0%A6%E0%B1%8D%E0%B0%AD%E0%B1%81%E0%B0%A4%E0%B0%AE%E0%B1%88%E0%B0%A8-%E0%B0%AE%E0%B0%BE%E0%B0%B0/ HTTP/1.1" 200 18082 "-" "Amazon CloudFront"

My fail2ban filter is :

[Definition]
failregex = <HOST> - - .*(POST|GET) .* HTTP.* 403 .*$
ignoreregex =

And My fail2ban jail is :

[httpd-forbidden]
enabled = true
filter = httpd-forbidden
logpath = /var/log/nginx/example.com_custom.access.log
bantime = 1800
findtime = 300
maxretry = 50
port = 80,443
banaction = iptables-multiport

Please help to correct fail2ban regex.

1

This should work for your case if the first ip is the one needing a ban

[Definition]
failregex = ^<HOST>,.*"(POST|HEAD|GET|PUT).*HTTP.*" 403 .*$
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.