Fail2ban persistent banning
Fail2ban persistent banning Excerpt Persistent IP banning using Fail2ban’s recidive jail. If you are using Fail2ban, there is no standard recommended way to persistently ban IPs. Some people recommend to do this outside of Fail2ban, using e.g. iptables-persistent, which is actually super easy to install and configure. But let’s say, we don’t want to install any extras and want to accomplish the same with Fail2ban, as we already have fail2ban on every single host (which is a must!). But this did not work out for me. The thing is, if we extend actionstart in action.d/iptables-multiport.conf (or iptables-multiport.local override) as recommended in above tutorials, that is not going to add any IPs on a Fail2ban restart, but only once the first IP gets added to any jail. So these are my two proposed solutions: Using recidive jail (ban for 1 week) The provided recidive jail/filter monitors the fail2ban log file, and enables you to add long time bans for ip addresses that get banned by fail2ban multiple times. Default configuration looks like this: jail.conf [recidive] logpath = /var/log/fail2ban.log banaction = %(banaction_allports)s bantime = 1w findtime = 1d Simply enable this jail, e.g. in jail.d/custom.conf: jail.d/custom.conf [recidive] enabled = true We could then ban an IP manually for a whole week by adding it to that jail: