thanks dude..
now i have new problem..
where is variable declaration on fail2ban?
because i must change iptables-multiport.conf. i must change this code
action start = iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
actionstop =  iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP

 and i will change it to be like this

action start = iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
actionstop =  iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
actionban = iptables -I fail2ban-<name> 1 -s <ip> -d <destination> -j DROP
actionunban = iptables -D fail2ban-<name> -s <ip> -d <destination> -j DROP

i put destination variable in jail.local
ex:
[vsftpd]
enabled  = true
port      = ftp,ftp-data,ftps,ftps-data
filter   = vsftpd
logpath  = /media/log/logftp/vsftpd.log
maxretry = 2
destination = 192.168.40.20
the destination is an IP from ftp server

thanks before...:)

Dari: Yaroslav Halchenko <lists@onerussian.com>
Kepada: fail2ban-users@lists.sourceforge.net
Dikirim: Selasa, 27 Maret 2012 1:15
Judul: Re: [Fail2ban-users] Bls: Bls: Bls: please help me

>    Mon Mar 26 14:01:11 2012 [pid 2] CONNECT: Client "172.16.30.2"
>    >...<
>    [2]
>         172.16.30.2 (Mon Mar 26 14:01:12 2007)
>         172.16.30.2 (Mon Mar 26 14:01:18 2007)
>         172.16.30.2 (Mon Mar 26 14:01:24 2007)

oy -- how that could be (year in the log is 2012 while fail2ban-regex
reports 2007)... just wondering -- is the date on that box correctly
set?  what is output of 'date' command?

--
=------------------------------------------------------------------=
Keep in touch                                    www.onerussian.com
Yaroslav Halchenko                www.ohloh.net/accounts/yarikoptic

------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here
http://p.sf.net/sfu/sfd2d-msazure
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users