4

I have installed fail2ban and I am trying to get it set up to block IP addresses that appear in a certain message that appears in the syslog. The message in the syslog is:

racoon: ERROR: Invalid exchange type 243 from 103.14.62.181[11950]

Usually each message has a different IP address and the number in brackets (port?) is different as well. It looks like I can create a custom filter by doing the following:

racoon: ERROR: Invalid exchange type 243 from <HOST>

But my question is, can I stop there and will fail2ban do its thing, or do I need to specify something like this:

racoon: ERROR: Invalid exchange type 243 from <HOST>[IDONTKNOWWHATGOESHERE]

If I need to specify something like the above, what would be the effective wildcard that should appear in the brackets? The fail2ban documentation about OpenVPN (closest example) shows this:

http://www.fail2ban.org/wiki/index.php/OpenVPN

* <HOST>:[0-9]{4,5} Connection reset, restarting \[[0-9]{1,2}\]

It looks like they are using [0-9]{4,5} as a wildcard for the port number. Would that work in my case, or no?

Am I completely off base with my example for my filter?

The ultimate goal here is to have anything that fails with a 243 exchange error to be added to the IP Tables with a DROP flag. I may have more questions about my filter and what not after I get the initial question answered.

4

Yes, you can stop there and fail2ban will do it's thing. You can test this with the fail2ban-regex(1) utility. The summary is

fail2ban-regex [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]

so using the work you have done (Note that I had to add a datetime to the start of your provided log entry otherwise it complains.)

fail2ban-regex "Mar  3 07:36:19 racoon: ERROR: Invalid exchange type 243 from 103.14.62.181[11950]" "racoon: ERROR: Invalid exchange type 243 from <HOST>"

Running tests
=============

Use regex line : racoon: ERROR: Invalid exchange type 243 from <HOST>
Use single line: Mar  3 07:36:19 racoon: ERROR: Invalid exchange ty...

Matched time template MONTH Day Hour:Minute:Second
Got time using template MONTH Day Hour:Minute:Second

Results
=======

Failregex: 1 total
|- #) [# of hits] regular expression
|  1) [1] racoon: ERROR: Invalid exchange type 243 from <HOST>
`-

Ignoreregex: 0 total

Summary
=======

Addresses found:
[1]
    103.14.62.181 (Mon Mar 03 07:36:19 2014)

Date template hits:
2 hit(s): MONTH Day Hour:Minute:Second

Success, the total number of match is 1
  • Thanks, Lain. I believe this is going to help out a lot. So can you confirm that the following will be correct? Create a custom filter for these events – locutusoftron Mar 4 '14 at 16:20
  • @locutusoftron: Yep, I would add a custom filter to filter.d and then configure/enable it in the jail.conf. – Iain Mar 4 '14 at 16:30
  • @locutusoftron: SF isn't a forum, you ask a question, get answers and if you want ask more questions. not followups like this. Before continuing. documentation and man pages are your friend - we really value your attempting to figure things out yourself first. – Iain Mar 4 '14 at 17:12
  • I found my answer. Thanks for your assistance lain. – locutusoftron Mar 4 '14 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.