I have a file of blacklisted IPs that get loaded through fail2ban
into iptables
when fail2ban
starts up.
Assuming the initial list looks like this at startup:
Chain fail2ban-ip-blacklist (1 references)
target prot opt source destination
DROP all -- 120.25.68.125 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-wordress (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Why would I get a notification in my logs after startup that 120.25.68.125
has been banned and revisit the iptables status to see this:
Chain fail2ban-ip-blacklist (1 references)
target prot opt source destination
DROP all -- 120.25.68.125 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-wordress (1 references)
target prot opt source destination
REJECT all -- 120.25.68.125 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Shouldn't the IP 120.25.68.125
already be blocked and not need to be re-added to the ban list? Why is traffic from 120.25.68.125
being let back through?
Update: Full iptables
output
Chain INPUT (policy ACCEPT 1393 packets, 164K bytes)
pkts bytes target prot opt in out source destination
1401 164K fail2ban-wordpress tcp -- * * 0.0.0.0/0 0.0.0.0/0
1410 165K fail2ban-repeatoffender all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1207 packets, 1786K bytes)
pkts bytes target prot opt in out source destination
Chain fail2ban-repeatoffender (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 120.25.68.125 0.0.0.0/0
Chain fail2ban-wordpress (1 references)
pkts bytes target prot opt in out source destination
1401 164K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
iptables -L -v
)