I would like to change the Input number of the fail2ban rule in iptables to not be on the top (no.1) just to be added after all other rules. (after removing the rule it gets back every time).
1 Answer
Depends on the fail2ban version. In general case you should change the actionstart
or the fwstart
command. Also, you can completely comment this action and add corresponded rules manually in your rule set. Other way is just change -I <chain>
to -A <chain>
to add the rule at the end of the INPUT
chain.
In the recent fail2ban you need check the file /etc/fail2ban/action.d/iptables-multiport.conf
.
Change it like that:
actionstart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -A <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>