2

Running fail2ban 0.8.14 on CentOS 6.5 with Python 2.6.6, fail2ban puts my IP in the banned list, but doesn't actually prevent me from logging in.

Here's an example of a failed ban in /var/log/fail2ban.log (I think?):

ERROR iptables -D fail2ban-SSH -s xxx.xxx.xxx.xxx -j REJECT --reject-with icmp-port-unreachable returned 100

Interestingly, I have this working on two other machines, one of which is CentOS 6.6 and the other is CentOS 6.5, and the jail.conf and jail.local files are identical on both.

I have restarted fail2ban multiple times, added the Port = <my number> directive to the jail.local file under [ssh-iptables], but still no luck.

Again, when running fail2ban-client status ssh-iptables, the IP shows up in the banned IP list, but I can still log in.

Any ideas what might be causing the problem?

UPDATE: It appears to work intermittently. After about 20 minutes of waiting, it finally prevented my login. So I guess there's just a huge delay?

2

It would have been helpful to see the state of your iptables while you are experiencing the problem.
fail2ban doesnt actually perform the blocking of connection requests, it only adds the rules to the iptables firewall when it detects a bannable action, as defined in your jail.conf.local.
So you should first be checking the state of iptables

sudo iptables -S

and making sure, that the DROP rule corresponding to machine your are trying to get banned is present and configured properly.
the log:

ERROR iptables -D fail2ban-SSH -s xxx.xxx.xxx.xxx -j REJECT --reject-with icmp-port-unreachable returned 100

looks like fail2ban tried to unban the xxx.xxx.xxx.xxx IP (after the unban period had elapsed), by removing the DROP rule from fail2ban-ssh chain.
It looks like it returned an error 100 exit code, possibly because the rule it was trying to -D (delete) wasnt present, which might also explain why your not being blocked - the DROP rule wasnt properly loaded into iptables.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.