4

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block.

Basicaly, a packet is from the UDP protocol, and is a short packet, then I would like the host for that packet to be banned by IPTables via Fail2Ban.

03-serv:~# cat /var/log/kern.log | grep ' UDP: short packet: From '
Dec 19 16:05:12 03-serv kernel: UDP: short packet: From 74.60.6.213:1900 311/299 to x.x.x.x:27015
Dec 19 16:05:57 03-serv kernel: UDP: short packet: From 1.215.252.130:1900 11297/286 to x.x.x.x:27015
Dec 19 16:08:17 03-serv kernel: UDP: short packet: From 184.0.249.136:1900 363/299 to x.x.x.x:27015
Dec 19 16:09:54 03-serv kernel: UDP: short packet: From 1.214.66.49:1900 11297/310 to x.x.x.x:27015
Dec 19 16:11:28 03-serv kernel: UDP: short packet: From 1.214.214.2:1900 11297/320 to x.x.x.x:27015
Dec 19 18:00:45 03-serv kernel: UDP: short packet: From 74.60.171.197:1900 295/279 to x.x.x.x:27015
Dec 19 18:00:59 03-serv kernel: UDP: short packet: From 112.155.240.24:1900 11297/300 to x.x.x.x:27015
Dec 20 16:02:07 03-serv kernel: UDP: short packet: From 1.220.200.162:1900 11297/312 to x.x.x.x:27015
Dec 20 16:02:30 03-serv kernel: UDP: short packet: From 1.215.123.171:1900 11297/302 to x.x.x.x:27015

Here is my final Fail2Ban jail in jail.conf:

[ddos]
enabled   = true
port      = 27015
protocol  = udp
filter    = ddos
logpath   = /var/log/kern.log
maxretry  = 3
bantime   = 6000

And here is my anti short UDP configuration in /etc/fail2ban/filter.d/ddos.conf:

[Definition]

# Option:  failregex
# Notes.:  Auto block short UDP.
# Values:  TEXT
#
failregex = ^.*kernel: UDP: short packet: From <HOST>:.*$

ignoreregex =
  • No single quotes around regex. – Zimmi Dec 20 '14 at 18:31
  • I just see that :) now it working :) failregex = ^.*kernel: UDP: short packet: From <HOST>:.*$ – mikael karlsson Dec 20 '14 at 18:39
8

The failregex needs to match the full output, and can take the form of a full regular expression, so something like so:

'^.*kernel: UDP: short packet: From <HOST>:.*$'

You can test your regular expressions by using (documentation):

fail2ban-regex -v /var/log/kern.log /etc/fail2ban/filter.d/ddos.conf

Tested and verified below:

cwatson@loki:~$ cat ./kern.log
Dec 19 16:05:12 03-serv kernel: UDP: short packet: From 74.60.6.213:1900 311/299 to x.x.x.x:27015
Dec 19 16:05:57 03-serv kernel: UDP: short packet: From 1.215.252.130:1900 11297/286 to x.x.x.x:27015
Dec 19 16:08:17 03-serv kernel: UDP: short packet: From 184.0.249.136:1900 363/299 to x.x.x.x:27015
Dec 19 16:09:54 03-serv kernel: UDP: short packet: From 1.214.66.49:1900 11297/310 to x.x.x.x:27015
Dec 19 16:11:28 03-serv kernel: UDP: short packet: From 1.214.214.2:1900 11297/320 to x.x.x.x:27015
Dec 19 18:00:45 03-serv kernel: UDP: short packet: From 74.60.171.197:1900 295/279 to x.x.x.x:27015
Dec 19 18:00:59 03-serv kernel: UDP: short packet: From 112.155.240.24:1900 11297/300 to x.x.x.x:27015
Dec 20 16:02:07 03-serv kernel: UDP: short packet: From 1.220.200.162:1900 11297/312 to x.x.x.x:27015
Dec 20 16:02:30 03-serv kernel: UDP: short packet: From 1.215.123.171:1900 11297/302 to x.x.x.x:27015

cwatson@loki:~$ fail2ban-regex -v ./kern.log "^.*kernel: UDP: short packet: From <HOST>:.*$"

Running tests
=============

Use   failregex line : ^.*kernel: UDP: short packet: From <HOST>:.*$
Use         log file : ./kern.log


Results
=======

Failregex: 9 total
|-  #) [# of hits] regular expression
|   1) [9] ^.*kernel: UDP: short packet: From <HOST>:.*$
|      74.60.6.213  Fri Dec 19 16:05:12 2014
|      1.215.252.130  Fri Dec 19 16:05:57 2014
|      184.0.249.136  Fri Dec 19 16:08:17 2014
|      1.214.66.49  Fri Dec 19 16:09:54 2014
|      1.214.214.2  Fri Dec 19 16:11:28 2014
|      74.60.171.197  Fri Dec 19 18:00:45 2014
|      112.155.240.24  Fri Dec 19 18:00:59 2014
|      1.220.200.162  Sat Dec 20 16:02:07 2014
|      1.215.123.171  Sat Dec 20 16:02:30 2014
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [9] MONTH Day Hour:Minute:Second
|  [0] WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second
|  [0] Year/Month/Day Hour:Minute:Second
|  [0] Day/Month/Year Hour:Minute:Second
|  [0] Day/Month/Year2 Hour:Minute:Second
|  [0] Day/MONTH/Year:Hour:Minute:Second
|  [0] Month/Day/Year:Hour:Minute:Second
|  [0] Year-Month-Day Hour:Minute:Second[,subsecond]
|  [0] Year-Month-Day Hour:Minute:Second
|  [0] Year.Month.Day Hour:Minute:Second
|  [0] Day-MONTH-Year Hour:Minute:Second[.Millisecond]
|  [0] Day-Month-Year Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second[.Millisecond]
|  [0] TAI64N
|  [0] Epoch
|  [0] ISO 8601
|  [0] Hour:Minute:Second
|  [0] <Month/Day/Year@Hour:Minute:Second>
|  [0] YearMonthDay Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second
`-

Lines: 9 lines, 0 ignored, 9 matched, 0 missed
  • I did not get the same result as you do. – mikael karlsson Dec 20 '14 at 18:31
  • works now without '' and -v in fail2ban-regex. /Thanks! – mikael karlsson Dec 20 '14 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.