I am running Ubuntu Linux 16.04 on a GCP Compute Engine VM instance. This is hosting a web server for a web application. I need feedback from the community about verification that what I have set up on Ubuntu Linux is correct and that I can verify that bad IP addresses are in fact getting blocked.
I have set up fail2ban and created the following jail:
#To stop DOS attack from remote host. [http-get-dos] enabled = true port = http,https filter = http-get-dos logpath = /var/log/apache*/access.log maxretry = 1 findtime = 86400 bantime = -1 ignoreip = 111.222.333.12 # action = iptables[name=HTTP, port=http, protocol=tcp] banaction=iptables-ipset-proto4
I have ipset and iptables configured as follows:
sudo iptables -I INPUT -m set --match-set f2b-http-get-dos src -j DROP sudo iptables -I FORWARD -m set --match-set f2b-http-get-dos src -j DROP
When I query the ipset set name f2b-http-get-dos, I see numerous members listed. For example:
Name: f2b-http-get-dos Type: hash:ip Revision: 4 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 3928 References: 3 Number of entries: 83 Members: XX.XXX.XX.XX XX.XXX.XX.XX
When I query iptables I see (excerpted):
sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination DROP all -- anywhere anywhere match-set f2b-http-get-dos src REJECT tcp -- anywhere anywhere multiport dports http,https match-set f2b-http-get-dos src reject-with icmp-port-unreachable LOG all -- anywhere anywhere LOG level warning Chain FORWARD (policy ACCEPT) target prot opt source destination DROP all -- anywhere anywhere match-set f2b-http-get-dos src
How do I know and confirm that the banned IP addresses that are listed in the set named in ipset are being firewalled by iptables? Does iptables write a log file that it maintains that tracks IP addresses it intercepted and blocked using a rule or finding the IP in an defined set name via ipset.