Iptables – Fail2ban not configuring properly

fail2baniptables

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly.

Any help please?
Thanks!

My iptables -L:
http://pastebin.com/srks3DyH

Best Answer

Your iptables -L-output looks normal, for a fail2ban-setup that haven't detected anything bad going on.

Verify the following:

is fail2ban running? Run ps aux | grep fail2ban, you should see a fail2ban-server-process.
Does /var/log/fail2ban.log have any content? (If this file does not exist, check /etc/fail2ban/fail2ban.conf for logtarget.)
Does /etc/fail2ban/filter.d/ssh.conf exist?
Does /etc/fail2ban/action.d/iptables.conf exist?

If you still can't figure it out, it would be cool if you added the Linux-distribution, and version of fail2ban in use. You should also provide what kind of attack you want to defend yourself against. I have assumed ssh brute-force above.

Related Solutions

Iptables – How to Unban an IP properly with Fail2Ban

With Fail2Ban before v0.8.8:

fail2ban-client get YOURJAILNAMEHERE actionunban IPADDRESSHERE

With Fail2Ban v0.8.8 and later:

fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE

The hard part is finding the right jail:

Use iptables -L -n to find the rule name...
...then use fail2ban-client status | grep "Jail list" | sed -E 's/^[^:]+:[ \t]+//' | sed 's/,//g' to get the actual jail names. The rule name and jail name may not be the same but it should be clear which one is related to which.

Centos – Fail2Ban does not ban VSFTPD users

I managed to get it working by using: /var/log/secure also for the VSFTPD log reading. Although the normal VSFTPD logs should also work, as they output similar data. The real problem here must be the failregex. But with the /var/log/secure it works.

Best Answer

Related Solutions

Iptables – How to Unban an IP properly with Fail2Ban

Centos – Fail2Ban does not ban VSFTPD users

Related Topic