fail2ban + iptables "already banned"

Philippe23

Hey, I'm looking for suggestions of what I might have misconfigured. I get a fair amount of these from fail2ban:

666threesixes666 · Posted: Sat Mar 01, 2014 6:55 pm Post subject:

your perception is what is off..... the ip is already banned, and they are attacking more, and fail2ban is trying to ban them again but they are already banned.

Philippe23 · Posted: Sat Mar 01, 2014 7:19 pm Post subject:

That sure makes it sound like something is wrong, since they shouldn't be able to try again ... they're banned. It appears the ban is not being very effective for some reason in my setup.

666threesixes666 · Posted: Sat Mar 01, 2014 7:45 pm Post subject:

mmmm this brings up the point that our fail2ban wiki article need sites to provide test attacks..... you fix it, im sick of fixing that thing...

Hu · Moderator Joined: 06 Mar 2007 Posts: 21593

If you suspect something is wrong with your filter rules, then please show them. Use iptables-save -c.

Philippe23 · Posted: Sun Mar 02, 2014 12:46 am Post subject:

I think I figured it out. Since I had multiple iptables actions for each rule, but they all had the same name, but different ports. I think that was causing only the first (or last) being created. I switched to iptables-multiport instead. I'm going to see how that goes.

Philippe23 · Posted: Fri Mar 21, 2014 12:14 pm Post subject:

Yeah, that seemed to have fixed it. I haven't had an already banned message since I made the change 20+ days ago.

666threesixes666 · Posted: Fri Mar 21, 2014 5:56 pm Post subject:

migrate to sshguard, fail2ban is producing false negatives..... i made a wiki of sshguard

https://wiki.gentoo.org/wiki/Sshguard