1

Researching on the differences between Advanced Firewall Policy (APF) together with Brute Force Detection System (BFD) and Fail2Ban I couldn't find much. They use different methods, at the same time both solutions essentially do the same thing - they analyze logs files and based on predetermined patterns block offending IPs via iptables.

Nevertheless, there are lot's of tutorials which explain how to set both APF and Fail2Ban on the same systems, so they do not override each others' entries in iptables. And there I am confused: why to install two firewalls, which do the same thing? Or I am missing something? Do they complement each other? Does any them do something that the other solution does not?

2

They can complement each other as they test different violations. While Fail2ban and Brute Force Detection (BFD) has essentially the same purpose, APF does whole other things.

Advanced Policy Firewall (APF) monitors the contents of the connections, instead of log files. Connection based stateful policies checks that the packets matches the connection protocol, and sanity based policies drops both known attack patterns and malformed packets potentially used for attacks.

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time,

  • I agree that BFD does the same thing by analyzing logs, but then it only detects offending IPs, it doesn't do anything with them by itself, so it should send such IPs to firewall - it is usually APF, but BFD can actually send offending IPs directly to iptables. At the same time, are you sure Fail2ban and APF test different violations? I thought Fail2ban is also capable to protocols and do all other things APF can do. – Nick Aug 28 '17 at 5:43
  • Fail2ban scans log files. It can detect many things other than password failures, but not directly from the traffic. – Esa Jokinen Aug 28 '17 at 5:49
  • Fair enough. So you believe it's good to install APF+BFD and Fail2ban? Or should I go with just APF and Fail2ban? I'd like to wait for couple days to see if there will be more and alternative opinions on this and then I'll accept your answer. Thanks! – Nick Aug 28 '17 at 6:00
  • Out of these three only APF eats resources. Therefore, I don't see any disadvantages in having both BFD & Fail2ban along with AFD, as their analysis is rather light to perform. – Esa Jokinen Aug 28 '17 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.