Re: [Fail2ban-users] Fail2ban-users] HI fail2ban don block

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

Based on the creation of your chain 'fail2ban-portscan' It only blocks access to
ssh port, so other ports can still be touched from the outside.

fail2ban-portscan  tcp  --  anywhere             anywhere             tcp
dpt:ssh

Tom

i try block port scaners and i se his not working whereis trouble Â i blocked

in iptables

Chain fail2ban-portscan (1 references)

target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
DROP Â  Â  Â  all Â -- Â staticline-31-182-50-18.toya.net.pl Â anywhere Â  Â  

RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â
iptables -nL

Chain fail2ban-portscan (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â

DROP Â  Â  Â  all Â -- Â 31.182.50.18 Â  Â  Â  Â  0.0.0.0/0 Â  Â  Â  Â  Â Â
RETURN Â  Â  all Â -- Â 0.0.0.0/0 Â  Â  Â  Â  Â  Â 0.0.0.0/0 Â  Â  Â  Â 
Â Â

Â

what is wrong ?? (bad version of iptables )? when i block manual add rules to iptables is
workingÂ
Â

my iptables -L

Chain INPUT (policy DROP)

target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
fail2ban-NoProxy Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  multiport
dports http,https
fail2ban-BadBots Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  multiport
dports http,https

fail2ban-NoLoginFailures Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â 
multiport dports http,https
fail2ban-NoAuthFailures Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â 
multiport dports http,https

fail2ban-courierauth Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â 
multiport dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
fail2ban-couriersmtp Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â 
multiport dports smtp,ssmtp

fail2ban-ssh-ddos Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â 
multiport dports tcpmux:1000
fail2ban-portscan Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp
dpt:ssh
fail2ban-pam-generic Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â

fail2ban-ssh Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  multiport
dports ssh
ACCEPT Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  state
RELATED,ESTABLISHED
ACCEPT Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â

ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp dpt:http
ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp
dpt:https
ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp dpt:4343

ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp
dpt:http-alt
ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp dpt:smtp
ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp
dpt:submission

ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp dpt:pop3
ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp
dpt:pop3s
ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp
dpt:imap2

ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp
dpt:imaps
ACCEPT Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp dpt:ssh
ACCEPT Â  Â  icmp -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  icmp
echo-request

LOG Â  Â  Â  Â all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  LOG level
notice tcp-sequence tcp-options ip-options prefix "PORT DENIED: "
LOG Â  Â  Â  Â tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp dpt:https
u32 "0x34=0x18030000:0x1803ffff" LOG level warning prefix "BLOCKED: HEARTBEAT"

DROP Â  Â  Â  tcp Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â  tcp dpt:https
u32 "0x34=0x18030000:0x1803ffff"
Chain FORWARD (policy DROP)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â

Chain OUTPUT (policy ACCEPT)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
Chain fail2ban-BadBots (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â

RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â
Chain fail2ban-NoAuthFailures (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â

Chain fail2ban-NoLoginFailures (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â

Chain fail2ban-NoProxy (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â
Chain fail2ban-courierauth (1 references)

target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â
Chain fail2ban-couriersmtp (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â

RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â
Chain fail2ban-pam-generic (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â

Chain fail2ban-portscan (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
DROP Â  Â  Â  all Â -- Â staticline-31-182-50-18.toya.net.pl Â anywhere Â  Â  Â  Â  Â  Â

RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â
Chain fail2ban-ssh (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
DROP Â  Â  Â  all Â -- Â 76.146.97.119.broad.wh.hb.dynamic.163data.com.cn Â anywhere Â  Â  Â  Â  Â 
Â

RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere Â  Â  Â  Â  Â  Â
Chain fail2ban-ssh-ddos (1 references)
target Â  Â  prot opt source Â  Â  Â  Â  Â  Â  Â  destination Â  Â  Â  Â Â
RETURN Â  Â  all Â -- Â anywhere Â  Â  Â  Â  Â  Â  anywhere