I am attempting to ban a specific url in my jail.local configuration. The url is

Add_Product.php?union+select <-- Lots more follows this

ERROR  NOK: ('Unable to compile regular expression \'^(?:::f{4,6}:)?(?P<host>[\\w\\-.^_]*\\w) -.*"(GET|POST).*/Add_Product.php?*union+select\'',)

This url doesn't actually exist. We don't even run this query in our databases.

Here is the rule in my jail.local

enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
maxretry = 1
findtime = 10
bantime = 60000

Here is the rule in my filter.d/sql-union-select-attack.conf

#The SQL Injection attempt with "union+select+" in the URL     
failregex = ^<HOST> -.*"(GET|POST).*/Add_Product.php?*union+select+0x5e2526
ignoreregex =

Do I have a syntax error in my jail rule? I tried to use this question as a reference since I needed something similar. This attack attempt is bogging down my server.

Thank you.

  • 1
    Did you try plugging it in at regex101.com? It points out the syntax error in your regex. Oct 18, 2018 at 13:42
  • The error it is showing is "* The preceding token is not quantifiable" Oct 18, 2018 at 14:03
  • That's correct, you can't have zero or more of a ? as that character is also special. It's not clear why you have the * there. Oct 18, 2018 at 14:04
  • I'm trying to capture anything after Add_Product.php? and before union+select. There are id numbers after the php query string, and they're always different. Oct 18, 2018 at 14:08
  • Then you probably meant to use .* Oct 18, 2018 at 14:14

1 Answer 1


This fixed my problem. I tested on a VM and it dropped my connection successfully.

failregex = ^\d{4} <HOST> -.*\"(GET|POST).*Add_Product.php.*union+select

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.