1

I have a file of blacklisted IPs that get loaded through fail2ban into iptables when fail2ban starts up.

Assuming the initial list looks like this at startup:

Chain fail2ban-ip-blacklist (1 references)
target     prot opt source               destination         
DROP       all  --  120.25.68.125        0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0                      

Chain fail2ban-wordress (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Why would I get a notification in my logs after startup that 120.25.68.125 has been banned and revisit the iptables status to see this:

Chain fail2ban-ip-blacklist (1 references)
target     prot opt source               destination         
DROP       all  --  120.25.68.125        0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0                      

Chain fail2ban-wordress (1 references)
target     prot opt source               destination         
REJECT     all  --  120.25.68.125        0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Shouldn't the IP 120.25.68.125 already be blocked and not need to be re-added to the ban list? Why is traffic from 120.25.68.125 being let back through?

Update: Full iptables output

Chain INPUT (policy ACCEPT 1393 packets, 164K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1401  164K fail2ban-wordpress  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
 1410  165K fail2ban-repeatoffender  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1207 packets, 1786K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain fail2ban-repeatoffender (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       120.25.68.125        0.0.0.0/0                   

Chain fail2ban-wordpress (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1401  164K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
2
  • Implies that your blacklist chain isn't working. You probably need to include output of iptables -l -v (from memory) Sep 10, 2015 at 17:24
  • I added the full output (iptables -L -v)
    – bschaeffer
    Sep 10, 2015 at 18:16

1 Answer 1

1

You need to swap the order of the fail2ban-wordpress and fail2ban-repeatoffender rules in your INPUT chain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .