0

I have setup fail2ban with this Tutorial http://wireflare.com/permanently-ban-repeat-offenders-with-fail2ban/ and it seems working. But the attackers are changing their IPs and thats why I decided to block the Range manually.

This is the output of "iptables -S"

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N fail2ban-apache
-N fail2ban-apache-overflows
-N fail2ban-ip-blocklist
-N fail2ban-postfix
-N fail2ban-proftpd
-N fail2ban-repeatoffender
-N fail2ban-sasl
-N fail2ban-sasl-blocklist
-N fail2ban-ssh
-N fail2ban-ssh-blocklist
-N fail2ban-ssh-ddos
-N ufw-after-forward
-N ufw-after-input
-N ufw-after-logging-forward
-N ufw-after-logging-input
-N ufw-after-logging-output
-N ufw-after-output
-N ufw-before-forward
-N ufw-before-input
-N ufw-before-logging-forward
-N ufw-before-logging-input
-N ufw-before-logging-output
-N ufw-before-output
-N ufw-logging-allow
-N ufw-logging-deny
-N ufw-not-local
-N ufw-reject-forward
-N ufw-reject-input
-N ufw-reject-output
-N ufw-skip-to-policy-forward
-N ufw-skip-to-policy-input
-N ufw-skip-to-policy-output
-N ufw-track-input
-N ufw-track-output
-N ufw-user-forward
-N ufw-user-input
-N ufw-user-limit
-N ufw-user-limit-accept
-N ufw-user-logging-forward
-N ufw-user-logging-input
-N ufw-user-logging-output
-N ufw-user-output
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh-blocklist
-A INPUT -p tcp -j fail2ban-ip-blocklist
-A INPUT -p tcp -j fail2ban-repeatoffender
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache
-A INPUT -p tcp -m multiport --dports 25,465 -j fail2ban-postfix
-A INPUT -p tcp -m multiport --dports 25,465,143,220,993,110,995 -j fail2ban-sasl-blocklist
-A INPUT -p tcp -m multiport --dports 25,465,143,220,993,110,995 -j fail2ban-sasl
-A INPUT -p tcp -m multiport --dports 21,20,990,989 -j fail2ban-proftpd
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-overflows
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh-ddos
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A INPUT -j LOG
-A INPUT -j LOG
-A INPUT -s 43.255.190.0/24 -j DROP
-A INPUT -s 77.35.0.0/16 -j DROP
-A INPUT -s 221.229.0.0/16 -j DROP
-A INPUT -s 58.218.0.0/16 -j DROP
-A INPUT -s 31.184.0.0/16 -j DROP
-A INPUT -s 66.135.38.0/24 -j DROP
-A INPUT -s 95.70.0.0/16 -j DROP
-A INPUT -s 90.151.0.0/16 -j DROP
-A INPUT -s 93.177.0.0/16 -j DROP
-A INPUT -s 59.45.0.0/16 -j DROP
-A INPUT -s 182.100.0.0/16 -j DROP
-A INPUT -s 95.70.0.0/16 -j DROP
-A INPUT -s 80.82.0.0/16 -j DROP
-A INPUT -s 43.255.0.0/16 -j DROP
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j LOG
-A FORWARD -j LOG
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A fail2ban-apache -j RETURN
-A fail2ban-apache-overflows -j RETURN
-A fail2ban-ip-blocklist -s 80.82.70.167/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 95.70.11.191/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 90.151.18.181/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 95.70.118.101/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 93.177.38.30/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 77.35.237.38/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 77.35.123.98/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.188/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 66.135.38.206/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 194.63.142.101/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 182.100.67.115/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.152/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 95.70.120.147/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.139/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.126/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.93/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.144/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 59.45.79.116/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.171/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 58.218.204.248/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.168/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.89/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.118/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 31.184.194.115/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 58.218.204.226/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 221.229.166.29/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 117.21.174.111/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 78.37.215.18/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 43.255.190.191/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -s 221.229.166.30/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ip-blocklist -j RETURN
-A fail2ban-postfix -s 95.159.158.40/32 -j DROP
-A fail2ban-postfix -s 77.35.24.1/32 -j DROP
-A fail2ban-postfix -s 95.53.63.247/32 -j DROP
-A fail2ban-postfix -s 95.159.171.246/32 -j DROP
-A fail2ban-postfix -s 77.35.252.25/32 -j DROP
-A fail2ban-postfix -s 77.35.31.133/32 -j DROP
-A fail2ban-postfix -s 95.73.6.87/32 -j DROP
-A fail2ban-postfix -s 198.0.140.14/32 -j DROP
-A fail2ban-postfix -s 90.151.18.181/32 -j DROP
-A fail2ban-postfix -s 95.70.11.191/32 -j DROP
-A fail2ban-postfix -s 77.35.123.98/32 -j DROP
-A fail2ban-postfix -s 95.70.118.101/32 -j DROP
-A fail2ban-postfix -s 93.177.38.30/32 -j DROP
-A fail2ban-postfix -s 77.35.237.38/32 -j DROP
-A fail2ban-postfix -s 176.51.127.83/32 -j DROP
-A fail2ban-postfix -s 42.112.20.51/32 -j DROP
-A fail2ban-postfix -s 95.70.120.147/32 -j DROP
-A fail2ban-postfix -s 78.37.215.18/32 -j DROP
-A fail2ban-postfix -j RETURN
-A fail2ban-proftpd -j RETURN
-A fail2ban-repeatoffender -j RETURN
-A fail2ban-sasl -s 95.159.158.40/32 -j DROP
-A fail2ban-sasl -s 77.35.24.1/32 -j DROP
-A fail2ban-sasl -s 95.53.63.247/32 -j DROP
-A fail2ban-sasl -s 95.159.171.246/32 -j DROP
-A fail2ban-sasl -s 77.35.252.25/32 -j DROP
-A fail2ban-sasl -s 77.35.31.133/32 -j DROP
-A fail2ban-sasl -s 95.73.6.87/32 -j DROP
-A fail2ban-sasl -s 198.0.140.14/32 -j DROP
-A fail2ban-sasl -s 90.151.18.181/32 -j DROP
-A fail2ban-sasl -s 95.70.11.191/32 -j DROP
-A fail2ban-sasl -s 80.82.70.167/32 -j DROP
-A fail2ban-sasl -s 77.35.123.98/32 -j DROP
-A fail2ban-sasl -s 95.70.118.101/32 -j DROP
-A fail2ban-sasl -s 93.177.38.30/32 -j DROP
-A fail2ban-sasl -s 77.35.237.38/32 -j DROP
-A fail2ban-sasl -s 176.51.127.83/32 -j DROP
-A fail2ban-sasl -s 42.112.20.51/32 -j DROP
-A fail2ban-sasl -s 95.70.120.147/32 -j DROP
-A fail2ban-sasl -s 78.37.215.18/32 -j DROP
-A fail2ban-sasl -s 194.63.142.101/32 -j DROP
-A fail2ban-sasl -j RETURN
-A fail2ban-sasl-blocklist -j RETURN
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh-blocklist -j RETURN
-A fail2ban-ssh-ddos -j RETURN
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m state --state INVALID -j ufw-logging-deny
-A ufw-before-input -m state --state INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m state --state INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j DROP
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-output -p tcp -m state --state NEW -j ACCEPT
-A ufw-track-output -p udp -m state --state NEW -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 80 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 21 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 8443 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 25 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 993 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 993 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 587 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 587 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 443 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 443 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 115 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 571 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 571 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
-A ufw-user-input -s 77.35.0.0/16 -j DROP
-A ufw-user-input -s 95.159.0.0/16 -j DROP
-A ufw-user-input -s 95.53.0.0/16 -j DROP
-A ufw-user-input -s 95.73.0.0/16 -j DROP
-A ufw-user-input -s 198.0.0.0/16 -j DROP
-A ufw-user-input -s 90.151.0.0/16 -j DROP
-A ufw-user-input -s 80.82.0.0/16 -j DROP
-A ufw-user-input -s 93.177.0.0/16 -j DROP
-A ufw-user-input -s 176.51.0.0/16 -j DROP
-A ufw-user-input -s 195.70.0.0/16 -j DROP
-A ufw-user-input -s 194.63.0.0/16 -j DROP
-A ufw-user-input -s 78.37.0.0/16 -j DROP
-A ufw-user-input -s 42.112.0.0/16 -j DROP
-A ufw-user-input -s 95.70.0.0/16 -j DROP
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT

The /var/log/fail2ban.log

2015-04-15 13:56:13,584 fail2ban.actions: WARNING [sasl] Ban 198.0.140.14
2015-04-15 13:56:13,801 fail2ban.actions: WARNING [postfix] Ban 198.0.140.14
2015-04-15 15:20:58,784 fail2ban.actions: WARNING [sasl] Unban 90.151.18.181
2015-04-15 15:21:14,591 fail2ban.actions: WARNING [postfix] Unban 90.151.18.181
2015-04-15 15:21:18,634 fail2ban.actions: WARNING [postfix] Unban 95.70.11.191
2015-04-15 15:21:22,693 fail2ban.actions: WARNING [postfix] Unban 77.35.123.98
2015-04-15 15:21:27,751 fail2ban.actions: WARNING [postfix] Unban 77.35.237.38
2015-04-15 15:21:31,811 fail2ban.actions: WARNING [postfix] Unban 93.177.38.30
2015-04-15 15:21:34,865 fail2ban.actions: WARNING [postfix] Unban 95.70.118.101
2015-04-15 15:22:04,983 fail2ban.actions: WARNING [sasl] Unban 95.70.11.191
2015-04-15 15:22:09,044 fail2ban.actions: WARNING [sasl] Unban 77.35.123.98
2015-04-15 15:22:12,107 fail2ban.actions: WARNING [sasl] Unban 77.35.237.38
2015-04-15 15:22:15,158 fail2ban.actions: WARNING [sasl] Unban 93.177.38.30
2015-04-15 15:22:21,207 fail2ban.actions: WARNING [sasl] Unban 95.70.118.101
2015-04-15 15:22:25,278 fail2ban.actions: WARNING [sasl] Unban 80.82.70.167
2015-04-15 16:59:03,918 fail2ban.actions: WARNING [postfix] Ban 95.73.6.87
2015-04-15 16:59:04,269 fail2ban.actions: WARNING [sasl] Ban 95.73.6.87
2015-04-15 16:59:09,901 fail2ban.actions: WARNING [postfix] 95.73.6.87 already banned
2015-04-15 16:59:18,115 fail2ban.actions: WARNING [sasl] 95.73.6.87 already banned
2015-04-15 16:59:28,924 fail2ban.actions: WARNING [postfix] Ban 77.35.31.133
2015-04-15 16:59:29,127 fail2ban.actions: WARNING [sasl] Ban 77.35.31.133
2015-04-15 16:59:43,671 fail2ban.actions: WARNING [postfix] Ban 77.35.252.25
2015-04-15 16:59:44,875 fail2ban.actions: WARNING [sasl] Ban 77.35.252.25
2015-04-15 17:00:03,713 fail2ban.actions: WARNING [sasl] Ban 95.159.171.246
2015-04-15 17:00:04,045 fail2ban.actions: WARNING [postfix] Ban 95.159.171.246
2015-04-15 17:00:16,605 fail2ban.actions: WARNING [postfix] Ban 95.53.63.247
2015-04-15 17:00:17,177 fail2ban.actions: WARNING [sasl] Ban 95.53.63.247
2015-04-15 19:56:13,801 fail2ban.actions: WARNING [postfix] Unban 198.0.140.14
2015-04-15 19:56:14,229 fail2ban.actions: WARNING [sasl] Unban 198.0.140.14
2015-04-15 20:06:30,405 fail2ban.filter : WARNING Unable to find a corresponding IP address for time
2015-04-15 20:06:30,470 fail2ban.filter : WARNING Unable to find a corresponding IP address for time
2015-04-15 20:06:32,709 fail2ban.actions: WARNING [repeatoffender] Ban 221.229.166.30
2015-04-15 20:06:33,207 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.191
2015-04-15 20:06:34,083 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.190
2015-04-15 20:06:34,937 fail2ban.actions: WARNING [repeatoffender] Ban 90.151.18.181
2015-04-15 20:06:35,340 fail2ban.actions: WARNING [repeatoffender] Ban 78.37.215.18
2015-04-15 20:06:35,741 fail2ban.actions: WARNING [repeatoffender] Ban 117.21.174.111
2015-04-15 20:06:36,142 fail2ban.actions: WARNING [repeatoffender] Ban 221.229.166.29
2015-04-15 20:06:36,551 fail2ban.actions: WARNING [repeatoffender] Ban 58.218.204.226
2015-04-15 20:06:36,953 fail2ban.actions: WARNING [repeatoffender] Ban 31.184.194.115
2015-04-15 20:06:37,386 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.118
2015-04-15 20:06:38,220 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.117
2015-04-15 20:06:39,069 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.116
2015-04-15 20:06:39,899 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.152
2015-04-15 20:06:40,759 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.168
2015-04-15 20:06:41,637 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.163
2015-04-15 20:06:42,492 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.160
2015-04-15 20:06:43,189 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.167
2015-04-15 20:06:43,845 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.164
2015-04-15 20:06:44,503 fail2ban.actions: WARNING [repeatoffender] Ban 43.255.190.165
2015-04-15 20:06:45,171 fail2ban.actions: WARNING [repeatoffender] Ban 58.218.204.248

The /etc/fail2ban/jail.conf

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8
findtime = 10800
bantime  = 21600
maxretry = 3
action = %(action_mwl)s

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = auto

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
#destemail = admin@domain, fail2ban@blocklist.de
sendermail = admin@domain

#
# ACTIONS
# 

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-multiport

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

# Specify chain where jumps would need to be added in iptables-* actions
chain = INPUT

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
action = %(action_)s

#
# JAILS
#

# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
# was shipped in Debian. Enable any defined here jail by including
#
# [SECTION_NAME]
# enabled = true

# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 4
action = %(action_mwl)s


[dropbear]

enabled  = false
port     = ssh
filter   = sshd
logpath  = /var/log/dropbear
maxretry = 6

# Generic filter for pam. Has to be used with action which bans all ports
# such as iptables-allports, shorewall
[pam-generic]

enabled  = false
# pam-generic filter can be customized to monitor specific subset of 'tty's
filter   = pam-generic
# port actually must be irrelevant but lets leave it all for some possible uses
port     = all
banaction = iptables-allports
port     = anyport
logpath  = /var/log/auth.log
maxretry = 6

[xinetd-fail]

enabled   = false
filter    = xinetd-fail
port      = all
banaction = iptables-multiport-log
logpath   = /var/log/daemon.log
maxretry  = 2


[ssh-ddos]

enabled  = true
port     = ssh
filter   = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 3
action = %(action_mwl)s

#
# HTTP servers
#

[apache]

enabled  = true
port     = http,https
filter   = apache-auth
logpath  = /var/log/apache*/*error.log
maxretry = 6
action = %(action_mwl)s

# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]

enabled   = false
port      = http,https
filter    = apache-auth
logpath   = /var/log/apache*/*error.log
maxretry  = 6

[apache-noscript]

enabled  = false
port     = http,https
filter   = apache-noscript
logpath  = /var/log/apache*/*error.log
maxretry = 6

[apache-overflows]

enabled  = true
port     = http,https
filter   = apache-overflows
logpath  = /var/log/apache*/*error.log
maxretry = 2
action = %(action_mwl)s

#
# FTP servers
#

[vsftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = vsftpd
logpath  = /var/log/vsftpd.log
# or overwrite it in jails.local to be
# logpath = /var/log/auth.log
# if you want to rely on PAM failed login attempts
# vsftpd's failregex should match both of those formats
maxretry = 6


[proftpd]

enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
filter   = proftpd
logpath  = /var/log/auth.log
maxretry = 6
action = %(action_mwl)s


[pure-ftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = pure-ftpd
logpath  = /var/log/auth.log
maxretry = 6


[wuftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = wuftpd
logpath  = /var/log/auth.log
maxretry = 6


#
# Mail servers
#

[couriersmtp]

enabled  = false
port     = smtp,ssmtp
filter   = couriersmtp
logpath  = /var/log/mail.log


#
# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
# all relevant ports get banned
#

[postfix]

enabled  = true
port     = smtp,ssmtp
filter   = postfix
logpath  = /var/log/mail.log
maxretry = 3
action = %(action_mwl)s

[courierauth]

enabled  = false
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = courierlogin
logpath  = /var/log/mail.log


[sasl]

enabled  = true
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = sasl
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath  = /var/log/mail.log
maxretry = 3
action = %(action_mwl)s

[sasl-blocklist]
enabled = true
port    = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter  = sasl
logpath = /var/log/blocklist-error.log
maxretry = 3
bantime = 86400
action = %(action_mwl)s

[dovecot]

enabled = false
port    = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter  = dovecot
logpath = /var/log/mail.log

# These jails block attacks against named (bind9). By default, logging is off
# with bind9 installation. You will need something like this:
#
# logging {
#     channel security_file {
#         file "/var/log/named/security.log" versions 3 size 30m;
#         severity dynamic;
#         print-time yes;
#     };
#     category security {
#         security_file;
#     };
# };
#
# in your named.conf to provide proper logging

# !!! WARNING !!!
#   Since UDP is connection-less protocol, spoofing of IP and imitation
#   of illegal actions is way too simple.  Thus enabling of this filter
#   might provide an easy way for implementing a DoS against a chosen
#   victim. See
#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
#   Please DO NOT USE this jail unless you know what you are doing.
#[named-refused-udp]
#
#enabled  = false
#port     = domain,953
#protocol = udp
#filter   = named-refused
#logpath  = /var/log/named/security.log

[named-refused-tcp]

enabled  = false
port     = domain,953
protocol = tcp
filter   = named-refused
logpath  = /var/log/named/security.log

enabled  = false
port     = domain,953
protocol = tcp
filter   = named-refused
logpath  = /var/log/named/security.log


[ssh-blocklist]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/blocklist-error.log
maxretry = 4
action = %(action_mwl)s

[repeatoffender]

enabled  = true
filter   = repeatoffender
action   = repeatoffender[name=repeatoffender]
           sendmail-whois[name=Repeat-Offender, dest=admin@domain, sender=fail2ban@domain]
logpath  = /var/log/fail2ban*
maxretry = 3
findtime = 31536000
bantime  = -1

As you can see on the output of the iptables I blocked the IP Ranges but they still try to access the server. Is my fail2ban jail faulty? I don't have any idea.

1
  • Order matters in iptables rules, add the block or DROP rules above the ACCEPT ones. – Daniel t. Apr 15 '15 at 22:56
0

Use:

iptables -I INPUT -s 77.35.0.0/16 -j DROP
iptables -I INPUT -s 95.159.0.0/16 -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.