I've used fail2ban a while now. Today I wanted to learn more about iptables and found iptables-persistent.
After installing, saving and cleanup the iptables rules in /etc/iptables/rules.v4 it looks like this
# Generated by iptables-save v1.6.0 on Thu Aug 24 15:18:11 2017 *filter :INPUT DROP [107:22965] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [267:46575] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT -A INPUT -p udp -m udp --sport 53 -j ACCEPT -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT COMMIT # Completed on Thu Aug 24 15:18:11 2017
My /etc/fail2ban/jail.local contains the following lines
[...] bantime = 3600 maxretry = 2 [...] protocol = tcp chain = INPUT [...]
After restarting the Server, the fail2ban rule is appended instead of inserted at the top.
Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:22 ACCEPT tcp -- anywhere anywhere tcp spt:domain ACCEPT udp -- anywhere anywhere udp spt:domain ACCEPT tcp -- anywhere anywhere tcp spt:http f2b-sshd tcp -- anywhere anywhere multiport dports 22
If I type in a wrong login, I get banned and end in jail. But the fail2ban rule is at the end of the input chain, so I can still try and login if I use the correct login information.
How can I ensure that fail2ban is inserted at the top of the chain?