0

I would like to change the Input number of the fail2ban rule in iptables to not be on the top (no.1) just to be added after all other rules. (after removing the rule it gets back every time).

Image: Image

1 Answer 1

0

Depends on the fail2ban version. In general case you should change the actionstart or the fwstart command. Also, you can completely comment this action and add corresponded rules manually in your rule set. Other way is just change -I <chain> to -A <chain> to add the rule at the end of the INPUT chain.

In the recent fail2ban you need check the file /etc/fail2ban/action.d/iptables-multiport.conf.

Change it like that:

actionstart = iptables -N fail2ban-<name>
              iptables -A fail2ban-<name> -j RETURN
              iptables -A <chain> -p <protocol> -m multiport --dports <port> -j  fail2ban-<name>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .