1

My server currrently has very strict fail2ban rules, which permanently and persistently ban any ip that fails to login once on all ports. This might seem overkill, but most ports are "private" ports (meaning only I should access them).

Since my server runs a public website, ips should not be banned on HTTP & HTTPS, I also have setup an web interface to unban my ip, in case I lock myself out, which I then need to be able to access.

I don't have much expirence with firewalls & iptables and am currently using action.d/iptables-allports.conf with persistent bans.

How can I configure an action to ban the ip on all ports except for "public ports" or ban the ip on all "private ports" (given a static list of public / private ports)?

Thanks in advance. -Minding

migrated from security.stackexchange.com Jun 28 at 1:50

This question came from our site for information security professionals.

1

Quick thinking, instead of not banning these IPs from all ports, still go and ban them but let all traffic on ports 80 and 443 go through.

Add this rule to iptables and no one gets rejected on ports 80 and 443 even fail2ban still have them banned.

iptables -I INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
  • Way more elegant than my original proposal, thanks. – Minding Jun 30 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.