0

I recently installed fail2ban which has begun blocking bad ssh attempts.

I also set up an additional filter to permanently ban repeat offenders.

I notice now that there are some entries in my iptables that are there as DNS hostnames instead of raw IP addresses, which is obviously a terrible idea.

I have added use_dns = no in my /etc/fail2ban/fail2ban.conf, and have added UseDNS no to /etc/ssh/sshd_config. I've restarted both services, but those iptables entries still are showing up as host names instead of IP addresses.

What else could be causing the dns names? The permanent list of banned ips are being stored as raw IPs, so the translation seems to be happening behind the scenes as they are added by fail2ban at startup.

5

Are you checking these rules with iptables --list?

If so, try iptables --list -n to inhibit reverse DNS lookups.

To clarify, this is nothing to worry about. What you're seeing is merely the iptables client performing reverse DNS lookups for the listed IPs. As you'll likely find, the firewall rules are indeed being created using only the offending IP address.

  • Oh for pete's sake! Yes this was the issue. – Dale Anderson Aug 10 '15 at 17:15
  • Great! Glad I could be of help. – EEAA Aug 10 '15 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.