I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111:

Then I have installed fail2ban:

apt-get install fail2ban -y
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
service fail2ban restart
iptables -L

Then I try to SSH login from the ip After few wrong login, fail2ban add the follow line to iptables.

-A fail2ban-ssh -s -j REJECT --reject-with icmp-port-unreachable

After that, I try to login again with the right credential and I can login with no problem, from the IP

The iptables rule is still there.

Do I need additional configuration?

  • 3
    We would need to see the complete iptables ruleset for the INPUT and related chains. My guess is that there is an earlier rule that allows this connection. – user9517 Jan 16 '16 at 10:36
  • 3
    if you changed ssh port in sshd_config only but not in fail2ban config it bans your ip for port 22 but not 22111. – Dodge Jan 16 '16 at 11:03
  • 1
    @Dodge The iptables rule given by the OP as added does not specify a port, so should apply to all ports (and protocols). Iain's hypothesis sounds more credible to me. – user Jan 16 '16 at 11:58
  • @Iain here is the iptable: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A fail2ban-ssh -j RETURN – David Jan 16 '16 at 13:24
  • The fail2ban rules are in their own chain. You need a rule to pass new connections through the chain before the rules accepting the connection. This would likely be the second or third rule. It helps to check the counters in iptables to see which rules are being hit. – BillThor Jan 16 '16 at 15:41

As already mentioned in the comment, you need to change the port value in jail.local file to your custom port number that the ssh is listening to.


enabled  = true
port     = 22111 # custom port here
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 6

This is because, this port number is used to create the iptables rule for the INPUT chain, as below, from your post:

-N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh

See the value of --dports 22, which means those packet will be matched first that are destined for port 22 and hence, when you are trying to log into another port, it is not matching and therefore the flollowing rule for that specific ip is not getting employed:

-A fail2ban-ssh -s -j REJECT --reject-with icmp-port-unreachable

Change the port and restart fail2ban, and then check iptables rules again, you will see, it is changed and then thing should work as expected.

| improve this answer | |
  • In 'jail.local' changing the port from 22 to 22111 (my SSH port number) solved the problem. Thanks. – David Jan 18 '16 at 18:12
  • @David, You are welcome and glad that you could sort it out. – Diamond Jan 18 '16 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.