I've used fail2ban a while now. Today I wanted to learn more about iptables and found iptables-persistent.

After installing, saving and cleanup the iptables rules in /etc/iptables/rules.v4 it looks like this

# Generated by iptables-save v1.6.0 on Thu Aug 24 15:18:11 2017
:INPUT DROP [107:22965]
:OUTPUT ACCEPT [267:46575]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
# Completed on Thu Aug 24 15:18:11 2017

My /etc/fail2ban/jail.local contains the following lines

bantime = 3600
maxretry = 2
protocol = tcp
chain = INPUT

After restarting the Server, the fail2ban rule is appended instead of inserted at the top.

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:22
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:domain
ACCEPT     udp  --  anywhere             anywhere             udp spt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:http
f2b-sshd   tcp  --  anywhere             anywhere             multiport dports 22

If I type in a wrong login, I get banned and end in jail. But the fail2ban rule is at the end of the input chain, so I can still try and login if I use the correct login information.

How can I ensure that fail2ban is inserted at the top of the chain?


1 Answer 1


create a chain BANS (iptables -N BANS) inserted at the top of the input chain (iptables -I INPUT 1 -j BANS) and then set chain=BANS in fail2ban.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.