On 28-09-21 03:21:45, "Nick Howitt" <n...@howitts.co.uk> wrote:
On 28/09/2021 03:32, Frederic Jean wrote:
Hello community,
I have changed the iptables->actionban so that it runs a script instead of the
iptables command directly.
The other actions remained unchanged; I needed to do this as there are further
checks and actions I need to
do before banning an IP.
/etc/fail2ban/action.d/iptables.conf:
*# actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype> *
*actionban = /my/path/banip.pl <ip> <failures> <name> <blocktype>*
I reset iptables and reloaded fail2ban and tested manually to verify the script
is working:
% *fail2ban-client set asterisk-iptables banip 45.146.164.110*
The script is called, and parameters are correctly received. The script also
sends and email
which I received and the content is 100% the same as before this modification,
except for the fact that
I perform a DROP instead of a REJECT, here is the log and generated command:
2021-09-25 00:20:15 cr_banip.pl : (*45.146.164.110:40:ASTERISK:REJECT*)
Fail2ban BAN notification
2021-09-25 00:20:15 cr_banip.pl : Banning:
2021-09-25 00:20:15 cr_banip.pl : */sbin/iptables -I f2b-ASTERISK 1 -s
45.146.164.110 -j DROP*
I then can verify that it was added to iptables, by running "iptables -L" I get
this:
Chain f2b-ASTERISK (1 references)
target prot opt source destination
....
DROP all -- 45.146.164.110 anywhere
....
However, fail2ban still lists hits from the IP afterward and ultimately the IP
reaches the limit of 10 again and
it then just mentions that it was banned already:
2021-09-26 10:16:14,691 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:14,922 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:14,940 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:15,165 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:15,175 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:15,423 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:15,676 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:15,911 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:16,146 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:16,381 fail2ban.filter [5399]: INFO
[asterisk-iptables] Found 45.146.164.110
2021-09-26 10:16:16,381 fail2ban.actions [5399]: NOTICE
[asterisk-iptables] 45.146.164.110 *already banned *
If I revert my modification and reload fail2ban, this is how the iptables look
like after (it uses REJECT instead of DROP):
Chain f2b-ASTERISK (1 references)
target prot opt source destination
REJECT all -- 45.146.164.110 anywhere reject-with
icmp-port-unreachable
The iptables output seem to be ok though, from my point of view at least...
Thanks for any help!
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
Can I suggest you add a "-w" to your iptables command. You may find that your
own command without the -w is beating the actionstart command and stopping it from being
applied, so, although your chain f2b-ASTERISK looks OK, you may be missing the jump from
the INPUT chain to f2b-ASTERISK. Your logs may show this as well.
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
Thanks for replying;
I see what you mean, I tried adding it to the command but doing so and
reloading everything had the effect
of the rules not being inserted, the chain remained empty:
Chain f2b-ASTERISK (0 references)
pkts bytes target prot opt in out source
destination
I am unsure of what -w does; I am using iptables v1.4.7 and it is not
documented.
I am also using Fail2ban v0.9.6.
The lockingopt option in /etc/fail2ban/action.d/iptables-common.conf is also
empty.
Just for testing if I add it fail2ban complains that is shall be run using an
argument and got tons of errors.
Is there a way out of it?
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
