For some reason I cannot figure out, Fail2Ban refuses to add IP addresses to ipset/firewalld.
I'm being bruteforced by a chinese IP address, Fail2Ban does seem to actually attempt to ban it (at least it shows up in the fail2ban-client status sshd command), but it doesn't actually stop bruteforcing the server, and it doesn't show up in ipset/iptables/firewalld.
fail2ban-client status sshd:
[root@GITserver alex]# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 2 | |- Total failed: 93613 | `- File list: /var/log/secure `- Actions |- Currently banned: 2 |- Total banned: 1003 `- Banned IP list: 126.96.36.199 188.8.131.52
[root@GITserver alex]# ipset list [root@GITserver alex]# firewall-cmd --direct --get-all-rules [root@GITserver alex]#
Any ideas? more logs can be added on request
Edit, still no solution, still being bruteforced and DDoS'd, here's the complete /var/log/fail2ban.log if it may help https://paste.fedoraproject.org/paste/Y5aPF8~WY~fpuhaZBDo7Ml5M1UNdIGYhyRLivL9gydE=/raw (warning: 11mb)
ANY SUGGESTION WOULD BE VERY MUCH APPRECIATED. Still under attack.
Edit2: Looking at the logs it still seemed to use iptables, even though /etc/fail2ban/jail.d/00-firewalld.conf defined banaction=firewallcmd-ipset. I edited the main jail.conf to fix this, but it changed nothing. You can see the output after the reload in the log above.