1

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a bruteforce attack, it does add the offending IP address properly, however it flushes out my BLACkLIST chain, which I need to keep intact.

Any thoughts on why this is happening and how I can persist the BLACKLIST chain?

1

I assume you use shorewall as your firewall? If yes, you might want to change the action of fail2ban to shorewall instead of iptables in jail.conf:

...
[ssh-iptables]
enabled = false
...

[ssh-shorewall]
enabled  = true
filter   = sshd
action   = shorewall
logpath  = /var/log/auth.log                                                                    
maxretry = 5
....
  • Actually no I'm not using a shorewall setup. The box is a single Linode VPS instance using iptables for firewall rules. Am I doing something wrong? I can get fail2ban to ban an IP and add an iptables rule in the chain and flush it after the ban timeout, but it also flushes my blacklist chain that I created. – nulltek Oct 26 '14 at 18:21
  • You should rather use /etc/hosts.deny for blacklisting, then. Most modern daemons, including the openssh package on most distributions, use tcpwrapper. Fiddling with iptables is something you should only do if you really know what you are doing. – Markus W Mahlberg Oct 26 '14 at 20:19
  • I'm comfortable with iptables and have been using it for years and have custom chains blocking large CIDR blocks from accessing our server on all ports/protocols. I'm just trying to figure out why fail2ban is flushing my preconfigured chain set. Any ideas? – nulltek Oct 26 '14 at 21:45
  • Maybe because of the name? Have your tried to change it? Maybe to PREBLACKLIST? However, using tcpwrappers isn't a poor mans solution. Actually it is perfect for exactly your purpose, as changes are immediate and easily scriptable. – Markus W Mahlberg Oct 26 '14 at 22:48
  • Thanks for the tip, I'll look into tcpwrappers to block the traffic I want to avoid. I'd still like to get fail2ban to work properly. – nulltek Oct 27 '14 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.