Fail2ban – Why Isn’t Fail2ban Regenerating Its Iptables Chains on Ubuntu 18.04

This is really old but for people who search and find this, fail2ban and like a lot of other utilities are very configurable. You can change your fail2ban action files like iptables-multiport.conf to call iptables and create chains in the way you want it.

eg.

actionstart = iptables -N fail2ban-<name>
          iptables -A fail2ban-<name> -j RETURN
          iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>

This creates a rule smack bang in your INPUT chain which is kind of ugly and unmanageable, but you can quite easily put it in one of your own chains in your control. You can create an INPUT filter which then has chains to other filters for fail2ban to keep all it's stuff out of your INPUT chain as below.

actionstart = iptables -N fail2ban-<name>
          iptables -A fail2ban-<name> -j RETURN
          iptables -I INPUT-FAIL2BAN -p <protocol> -m multiport --dports <port> -j fail2ban-<name>

The same goes for libvirt or Xen where there are scripts that are called to do the work. Xen for instance uses /etc/xen/scripts which you'll find the network-bridge and others where iptables is called. Design it as you want.and worst case, change the code. I for one use fail2ban to modify a central firewall so all servers are protected which means iptables on the local machine doesn't show the rules anyway.

The iptables -s output looks correct and I don't know how 80.82.70.239/32 is getting to any:80 on your server through the firewall. My first guess is that you have a proxy / load balancer in front of the server and Apache is logging the HTTP_X_FORWARDED_FOR header or what ever that is called. If that turns out to be the case you will have to move your firewall logic to the proxy / load balancer or down to the application level (Apache mathing the FORWARDED_FOR header and deny access.

Either way:

The next course of action that I would take, is to capture the output of iptables -s you posted above. Disable fail2ban and load the configuration with the fail2ban chain and IP address blocked into iptables.

But do so with the following as the first -A rule:

-A INPUT -p tcp --dport 80 -j LOG --log-prefix "HTTP: "

If you would feel better trapping 80 and 443 go for it. The thought is that the logs from the FIREWALL may show something we are missing if we pay attention to the packets from suspect sources.