0

I am running fail2ban on CentOS 8 with ssh and Nginx configured. They both are showing ip's being blocked when I do the fail2ban-client status , but they are not actually being blocked by firewalld. I am being bombarded with ssh attacks and nothing is happening on the firewall side. I am running "tcpdump - i any port 80 or port 443 or port 22" and seeing multiple failed attempts. Again fail2ban sees them and says they are banned, but they are not actually baned. Any suggestions??

[DEFAULT] 
ignoreip = 127.0.0.1 192.168.1.0/24
bantime  = 21600
findtime  = 300
maxretry = 3
banaction = iptables-multiport
backend = systemd

[sshd] 
enabled = true

[nginx-http-auth]
enabled  = true
filter   = nginx-http-auth
port     = http,https
logpath  = /var/log/gitlab/nginx/error.log

[nginx-noscript]
enabled  = true
port     = http,https
filter   = nginx-noscript
logpath  = /var/log/gitlab/nginx/access.log
maxretry = 6

[nginx-badbots]
enabled  = true
port     = http,https
filter   = nginx-badbots
logpath  = /var/log/gitlab/nginx/access.log
maxretry = 2

[nginx-nohome]
enabled  = true
port     = http,https
filter   = nginx-nohome
logpath  = /var/log/gitlab/nginx/access.log
maxretry = 2

[nginx-noproxy]
enabled  = true
port     = http,https
filter   = nginx-noproxy
logpath  = /var/log/gitlab/nginx/access.log
maxretry = 2

[gitlab]
enabled = true
port = http,https
filter = gitlab
logpath = /var/log/gitlab/gitlab_error.log
2
  • Using fail2ban won’t prevent the offending traffic from showing up in a tcpdump packet capture.Tcpdump captures the incoming traffic before iptables rules are processed and take effect.... If fail2ban takes effects you should see that the offending IP-addresses no longer appear in the ssh and/or httpd access logs. – HermanB Dec 2 '20 at 4:37
  • YES, I am aware of what tcpdump does. What I am saying is that fail2ban bans ip 1.2.3.4 and when I do a "fail2ban-client status" the ip shows up there, but tcpdump is still showing the same ip 1.2.3.4 constantly attacking my system. Furthermore, firewalld does not show any ip's being banned. – user2236794 Dec 2 '20 at 15:23
1

If you're actually using firewalld, make sure you use a firewalld-compatible banaction such as firewallcmd-ipset.

0

Your config looks good, especially if you're seeing the ip listed in the output of fail2ban-client status sshd.

How are you checking if the ip has been banned? This is how I check it on a system that I'm responsible for with a banned ip.

            iptables -L f2b-sshd
Chain f2b-sshd (1 references)
target     prot opt source               destination         
REJECT     all  --  120.29.125.240       anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere

If it's not listed there, is it just that it's being banned and unbanned too quickly? I know you're config is set to 6 hours which should be long enough..

Failing that, you might also check /var/log/fail2ban.log for activity that might be relevant. For example:

2020-12-04 09:17:07,590 fail2ban.filter         [9089]: INFO    [sshd] Found 120.29.125.240
2020-12-04 09:17:09,883 fail2ban.filter         [9089]: INFO    [sshd] Found 120.29.125.240
2020-12-04 09:17:12,163 fail2ban.filter         [9089]: INFO    [sshd] Found 120.29.125.240
2020-12-04 09:17:14,381 fail2ban.filter         [9089]: INFO    [sshd] Found 120.29.125.240
2020-12-04 09:17:16,874 fail2ban.filter         [9089]: INFO    [sshd] Found 120.29.125.240
2020-12-04 09:17:17,805 fail2ban.actions        [9089]: NOTICE  [sshd] Ban 120.29.125.240

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.