Debian with iptables and fail2ban not ban IP

Question

I have server with Debian 9. I have installed fail2ban and configured it. It work with sshd (ban IP on failed logins) but i can't make it work with apache-auth (IP is ban but iptables don't block it).

jail.local look like:

[DEFAULT]
bantime  = 720h
findtime  = 60m
banaction = iptables
mta = sendmail
destemail = [email protected]
action = %(action_mw)s
maxretry = 2

[sshd]
enabled = true

[apache-auth]
enabled = true

When i run compand:

fail2ban-client status sshd

it show banned IP. When i run command:

iptables -L -n

It show IPs from previous command. So it's working correct.

When i run:

fail2ban-client status apache-auth

It show ban IP (me).

iptables -L -n

Don't show any IP from previous list. Can be important iptables shows:

Chain f2b-apache-auth (0 references)

And i still can connect to server via WWW. Exactly same issue i had with nginx so i switched to apache, i was thinking this will solve my issue.

Answer 1

My jail.conf part for apache looks a bit different

[apache]
enabled  = true
port     = http,https
filter   = apache-auth
logpath  = /var/log/apache*/*error.log
maxretry = 6

You can find the loaded configuration with

fail2ban-client -d

You said you are testing locally. Make sure your IP not in the netmask given in ignoreip.

As the action is probably triggered in your case have a look for the entry actionban there and see if it actually adds the desired iptables rule.

Maybe var/log/fail2ban.log has more information?

Answer 2

I have found solution!

[apache-auth]
enabled = true
action   = iptables-multiport[port="http,https"]
port     = http,https

'action' was missing. fail2ban was sending port range and iptables was expecting single port... after adding such "action" all is working great.

So we can say it's solved.

@Jonas Eberle - your config is in all tutorials, unfortunately was also not working :(