custom filter for Fail2Ban

Question

I have installed fail2ban and I am trying to get it set up to block IP addresses that appear in a certain message that appears in the syslog. The message in the syslog is:

racoon: ERROR: Invalid exchange type 243 from 103.14.62.181[11950]

Usually each message has a different IP address and the number in brackets (port?) is different as well. It looks like I can create a custom filter by doing the following:

racoon: ERROR: Invalid exchange type 243 from <HOST>

But my question is, can I stop there and will fail2ban do its thing, or do I need to specify something like this:

racoon: ERROR: Invalid exchange type 243 from <HOST>[IDONTKNOWWHATGOESHERE]

If I need to specify something like the above, what would be the effective wildcard that should appear in the brackets? The fail2ban documentation about OpenVPN (closest example) shows this:

http://www.fail2ban.org/wiki/index.php/OpenVPN

* <HOST>:[0-9]{4,5} Connection reset, restarting \[[0-9]{1,2}\]

It looks like they are using [0-9]{4,5} as a wildcard for the port number. Would that work in my case, or no?

Am I completely off base with my example for my filter?

The ultimate goal here is to have anything that fails with a 243 exchange error to be added to the IP Tables with a DROP flag. I may have more questions about my filter and what not after I get the initial question answered.

Answer 1

Yes, you can stop there and fail2ban will do it's thing. You can test this with the fail2ban-regex(1) utility. The summary is

fail2ban-regex [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]

so using the work you have done (Note that I had to add a datetime to the start of your provided log entry otherwise it complains.)

fail2ban-regex "Mar  3 07:36:19 racoon: ERROR: Invalid exchange type 243 from 103.14.62.181[11950]" "racoon: ERROR: Invalid exchange type 243 from <HOST>"

Running tests
=============

Use regex line : racoon: ERROR: Invalid exchange type 243 from <HOST>
Use single line: Mar  3 07:36:19 racoon: ERROR: Invalid exchange ty...

Matched time template MONTH Day Hour:Minute:Second
Got time using template MONTH Day Hour:Minute:Second

Results
=======

Failregex: 1 total
|- #) [# of hits] regular expression
|  1) [1] racoon: ERROR: Invalid exchange type 243 from <HOST>
`-

Ignoreregex: 0 total

Summary
=======

Addresses found:
[1]
    103.14.62.181 (Mon Mar 03 07:36:19 2014)

Date template hits:
2 hit(s): MONTH Day Hour:Minute:Second

Success, the total number of match is 1