Hello
I'm using fail2ban with shorewall to get rid some nasty
scanners.
As the amount is getting worse, I increased the time for my
bans on SSHD to 7 days as I recently got 1400+ connections a
day and I wanted it to stop.
But I experienced that even with that 7 days ban, the keep
connecting every ~ 10min.
Still ending up with 30-40 connections per IP.
So I cleaned my jail.local an only kept default, sshd and
the issues stay same.
Im using "shorewall" as banaction, and it works well for
the most part.
I can use "shorewall show dynamic" to see all the IP that
are banned ending up there.
BUT after some time, ~9min the ban just disappears from
"shorewall show dynamic" list. And the fail2ban doesnt show an
"unban" event. Shortly after that the IP connects, is detected
and banned again.
I manually added IP's to the shorewall banlist and I can
say that they don't disappear the same way the fail2ban IP's
do.
so for examle this list with custom and fail2ban IP's
Chain dynamic (5 references)
pkts bytes target prot opt in out source
destination
316 18960 DROP all -- * *
118.25.xxx.98
0.0.0.0/0 0 0 DROP all -- * *
182.162.xxx.185
0.0.0.0/0 0 0 DROP
all -- * * 192.0.0.2
0.0.0.0/0
(manually added 192.0.0) will look like
Chain dynamic (5 references)
pkts bytes target prot opt in out source
destination
0 0 DROP all -- * *
182.162.xxx.185
0.0.0.0/0
after some minutes and NO unban anywhere on the
fail2ban-logs
So currently there are 125 IP's "banned" by fail2ban SSH
but only ~30 actually appear in the shorewall banlist.
my jail.local:
#####
[DEFAULT]
bantime = 3600
banaction = shorewall
banaction_allports = shorewall
ignoreip = 127.0.0.1
maxretry = 3
[sshd]
enabled = true
port = ssh
bantime = 423360
findtime = 3600
maxretry = 1
#####
I'm using fail2ban-client version: 0.9.6
Any ideas what could cause the ban's to disappear? I
checked all logfiles for dropped IP's/bans but couldn't find
anything...
Regards
Steven
