fail2ban-users — The mailing list for help on getting Fail2Ban up and running on your machine

[Fail2ban-users] sshd "refused connect" messages because of /etc/hosts.deny

[Adam F. <a2...@du...>]

Hi

I have a lot of IP ranges blocked in /etc/hosts.deny, but I've noticed
fail2ban generating what I think is unnecessary noise for refused
connections from within those ranges. In other words, if an IP address
is already blocked by hosts.deny, I don't see why fail2ban needs to
jail it too.

Is there any reason to keep the line

  ^refused connect from \S+ \(<HOST>\)

in 'filter.d/sshd.conf'?

Thanks
Adam

[Fail2ban-users] ban action jump to custom nft chain

[Lars N. <la...@na...>]

Hi All, 

I'm trying to modify the default netfilter ban action from "reject with icmp port-unreachable" to jumping to a custom chain - to have the kernel to log dropped packets - which with iptables is possible with placeing "[Init] <nl> blocktype = <target>" in action.d/iptables-common.local. This does not work for nftables using nftables-common.local, at least when using "banaction = nftables[type=multiport]". 

Having [ https://www.google.com/search?q=fail2ban+jump+to+custom+nft+chain | browsed the net ] have not provided useful clues yet. Any ideas? 

Thank you very much, 

Lars 

[Fail2ban-users] f2b-sshd counter return mismatch with tcp dport 22 counter continue

[Truth <tr...@gm...>]

I'm using *nftables* and *fail2ban* on Debian 13 (trixie) and fail2ban 
is doing a great job.

However, when comparing some counters I realized that the *number of 
packages* returning from the *f2b-sshd* chain is always a little smaller 
rather than the number of packages counted by the subsequent *tcp dport 
22* *continue* rule within the input chain (see red numbers below).

I would like to understand where this difference comes from.
Suggestions and explanations are welcome.

My nftables look like this:


table inet mangel {
     set BOTNET {
         type ipv4_addr
         flags interval
         counter
         elements = { ... }
     }

     chain INGRESS {
         type filter hook ingress device <device> priority -500; policy 
accept;
         ip saddr @BOTNET counter packets x bytes y drop
     }

     chain PREROUTING {
         type filter hook prerouting priority mangle; policy accept;
         ct state invalid counter packets x bytes y drop
         ...
     }
}

table ip filter {
     chain FORWARD {
         type filter hook forward priority filter; policy drop;
     }

     chain OUTPUT {
         type filter hook output priority filter; policy drop;
         ...
     }

     chain INPUT {
         type filter *hook input* priority filter; policy drop;
         meta l4proto tcp tcp dport 22 counter packets 187 bytes 11849 
*jump* *f2b-sshd*
*tcp dport 22* counter packets *120* bytes 7813 continue
         iifname "lo" counter packets x bytes y accept
         ...
     }

     chain *f2b-sshd* {
         ip saddr u.v.w.z counter packets x bytes y drop
         ...
         counter packets *118* bytes 7709 *return*
     }
}

Re: [Fail2ban-users] [Asterisk+fail2ban v1.0.2] fail2ban-regex matches but daemon does not

[Pieter H. <pi...@tu...>]

Hi,

I just figured it out while reading a message on this list :) I had 
color coding enabled in Asterisk. This added extra characters in the 
actual log line. I figured this out using: fail2ban-regex -lHEAVYDEBUG 
systemd-journal[journalflags=1] asterisk[logtype=journal]

Met vriendelijke groet,
Pieter Hensen


On 2/17/26 13:40, Pieter Hensen wrote:
> Hi,
>
> I've been trying this for HOURS and just can't figure out what is 
> going wrong... I am running Asterisk (in a Docker container) and it is 
> logging to journald. Fail2ban is running on the host machine but this 
> does not really matter for the problem I am having.
>
> I am able to match a single log line (that I just copy/paste from 
> journalctl) using fail2ban-regex -vv but not using journald directly. 
> But if I take the Prefregex line that is output by fail2ban-regex, 
> paste it in regex101.com (https://regex101.com/r/XuydiL/1) and also 
> include some log lines, they do match!
>
> So this gives a match:
>
> fail2ban-regex -vv "Feb 17 11:28:49 s1 asterisk[584]: [Feb 17 
> 11:28:49] NOTICE[169]: res_pjsip/pjsip_distributor.c:673 
> log_failed_request: Request 'REGISTER' from 
> '<sip:6101@188.245.39.127>' failed for '94.23.150.225:51825' (callid: 
> 1052582086-1967824972-593464062) - Failed to authenticate" 
> asterisk[logtype=journal]
>
> This does not work:
>
> fail2ban-regex systemd-journal[journalflags=1] asterisk
>
> Running tests
> =============
>
> Use   failregex filter file : asterisk, basedir: /etc/fail2ban
> Use      datepattern : {^LN-BEG} : Default Detectors
> Use         systemd journal
> Use         encoding : UTF-8
> Use    journal match : CONTAINER_NAME=asterisk
>
>
> Results
> =======
>
> Prefregex: 0 total
> |  ^\s*(?:\S+\s+)?(?:asterisk(?:\s*\[\d+\])?:?\s+)?(?:kernel:\s?\[ 
> *\d+\.\d+\]:?\s+)?(?:\[[^\]]+\]\s+)?(?:NOTICE|SECURITY|WARNING)(?:\s*\[\d+\]):?(?:\[C-[\da-f]*\])?:? 
> [^:]+:\d*(?:(?: in)? [^:]+:)? (?P<content>.+)$
> `-
>
> Failregex: 0 total
>
> Ignoreregex: 0 total
>
> Date template hits:
>
> Lines: 7655 lines, 0 ignored, 0 matched, 7655 missed
>
>
> I've attached some more lines from my journal.
>
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users

[Fail2ban-users] [Asterisk+fail2ban v1.0.2] fail2ban-regex matches but daemon does not

[Pieter H. <pi...@tu...>]

Hi,

I've been trying this for HOURS and just can't figure out what is going 
wrong... I am running Asterisk (in a Docker container) and it is logging 
to journald. Fail2ban is running on the host machine but this does not 
really matter for the problem I am having.

I am able to match a single log line (that I just copy/paste from 
journalctl) using fail2ban-regex -vv but not using journald directly. 
But if I take the Prefregex line that is output by fail2ban-regex, paste 
it in regex101.com (https://regex101.com/r/XuydiL/1) and also include 
some log lines, they do match!

So this gives a match:

fail2ban-regex -vv "Feb 17 11:28:49 s1 asterisk[584]: [Feb 17 11:28:49] 
NOTICE[169]: res_pjsip/pjsip_distributor.c:673 log_failed_request: 
Request 'REGISTER' from '<sip:6101@188.245.39.127>' failed for 
'94.23.150.225:51825' (callid: 1052582086-1967824972-593464062) - Failed 
to authenticate" asterisk[logtype=journal]

This does not work:

fail2ban-regex systemd-journal[journalflags=1] asterisk

Running tests
=============

Use   failregex filter file : asterisk, basedir: /etc/fail2ban
Use      datepattern : {^LN-BEG} : Default Detectors
Use         systemd journal
Use         encoding : UTF-8
Use    journal match : CONTAINER_NAME=asterisk


Results
=======

Prefregex: 0 total
|  ^\s*(?:\S+\s+)?(?:asterisk(?:\s*\[\d+\])?:?\s+)?(?:kernel:\s?\[ 
*\d+\.\d+\]:?\s+)?(?:\[[^\]]+\]\s+)?(?:NOTICE|SECURITY|WARNING)(?:\s*\[\d+\]):?(?:\[C-[\da-f]*\])?:? 
[^:]+:\d*(?:(?: in)? [^:]+:)? (?P<content>.+)$
`-

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:

Lines: 7655 lines, 0 ignored, 0 matched, 7655 missed


I've attached some more lines from my journal.

-- 
Met vriendelijke groet,
Pieter Hensen

[Fail2ban-users] Apache <HOST> interpolation not populating <dns> (when value available)

[<sou...@te...>]

### Environment
- fail2ban/stable,now 1.1.0-8 all [installed]
- Linux 6.12.63+deb13-amd64 Debian 6.12.63-1 (2025-12-30)
- Package Manager installation method (apt-get)
- No applied Patches
- No customisation to stock configuration files

### The Issue

#### Summary
Filter parsing apache2/access.log, rejecting visitors by <HOST>
domain name fails because <dns> is not populated, yet the domain
name is present in the apache log file.

#### Steps to reproduce
1. Filter:
```
[Definition]
# Fail2Ban filter to scan Apache access.log for access by unwelcome Domains
# Version 0.1	(unfinished)
#
# Option:	failregex
# Values:	TEXT
baddomains	=	amazonaws|conectabalear|contaboserver|googleusercontent
prefregex	=	^<F-CONTENT><HOST></F-CONTENT>
failregex	=	%(baddomains)s
ignoreregex	=

# DEV Notes: Bibliography:-
# https://forum.hestiacp.com/t/updated-fail2ban-new-rules/20953
# https://me.jaytaala.com/implement-fail2ban-with-custom-apache-filter-ipset-and-a-sample-based-verification-approach/
# https://www.statusline.org/fail2ban-demystified-custom-fail2ban-actions 
# https://stackoverflow.com/questions/28463719/how-to-commit-a-regex-variable-to-the-action-script-in-fail2ban

```

2. Test Data (access.log intentionally truncated on RHS)
```
ec2-44-211-153-197.compute-1.amazonaws.com - - [11/Feb/2026:18:45:54 +0000]
vmi2951277.contaboserver.net - - [11/Feb/2026:23:31:26 +0000]
109.215.211.35.bc.googleusercontent.com - - [11/Feb/2026:05:10:21 +0000]
185.11.237.167.user.conectabalear.com - - [12/Feb/2026:07:28:07 +0000]
```

#### Expected behaviour (fail2ban-regex -lHEAVYDEBUG)
```
Pre-filter matched {'content': 'ec2-44-211-153-197.compute-1.amazonaws.com', 'ip4': None, 'ip6': None, 'dns': 'ec2-44-211-153-197.compute-1.amazonaws.com'}
 Pre-filter matched {'content': 'vmi2951277.contaboserver.net', 'ip4': None, 'ip6': None, 'dns': 'vmi2951277.contaboserver.net'}
 Pre-filter matched {'content': '109.215.211.35', 'ip4': '109.215.211.35', 'ip6': None, 'dns': '109.215.211.35.bc.googleusercontent.com}'
 Pre-filter matched {'content': '185.11.237.167', 'ip4': '185.11.237.167', 'ip6': None, 'dns': '185.11.237.167.user.conectabalear.com'}
```

#### Observed behaviour
```
Pre-filter matched {'content': 'ec2-44-211-153-197.compute-1.amazonaws.com', 'ip4': None, 'ip6': None, 'dns': 'ec2-44-211-153-197.compute-1.amazonaws.com'}
 Pre-filter matched {'content': 'vmi2951277.contaboserver.net', 'ip4': None, 'ip6': None, 'dns': 'vmi2951277.contaboserver.net'}
 Pre-filter matched {'content': '109.215.211.35', 'ip4': '109.215.211.35', 'ip6': None, 'dns': None}
 Pre-filter matched {'content': '185.11.237.167', 'ip4': '185.11.237.167', 'ip6': None, 'dns': None}
```

#### Any additional information
1. All four records in the access.log begin in column 1 with FQDN
2. Date format, etc, consistent.  (RHS truncated for readability)
3. Successful interpolation of <HOST> into <dns> on first two records
4. Unsuccessful population of <dns> on second two records
5. Failregex fails as <dns> not populated yet value present in <HOST>
6. Issue No and Status: None; awaiting community feedback/input first.

#### Configuration file datestamps (untouched).  NB: No apache-common.local
```
$ ls -l /etc/fail2ban/filter.d
...
-rw-r--r-- 1 root    root  1630 Apr 25  2024 apache-common.conf
...
-rw-r--r-- 1 root    root  2776 Apr 25  2024 common.conf
...
```

Re: [Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Wael K. <wa...@wa...>]

Hello,
Thanks a lot for the pointers, here's a link to the updated script with
even more detection options:
/etc/fail2ban/scripts/ban_range_from_ip.sh - http://0x0.st/Pc8G.sh
/etc/fail2ban/scripts/generate_ban_range_from_ip.sh -
http://0x0.st/Pc8D.sh

See, about the CIDR info: I noticed that usually whois indeed gives
CIDR and NetRange, but not always. And even sometimes only inetnum, so
now I have it detect that. And even then sometimes all three fail, and
this is why I'm using ifne on the pipe.

About the invocation, it is merely being used as a ban action or called
manually by me - basically automating work I did by hand where I'd look
for matches, take the addresses punch them into whois and then copy the
CIDR/calculate it from there and ban manually.

In any case, I still cannot get it to work as a ban action - for now I
just modified a copy of the default iptables actions to tack a /24 CIDR
by default and I'm only using that in jails where I'm quite sure of the
patterns matching abusive IP ranges, but a more flexible solution like
what I tried to achieve with the script would be nice to have.

I really appreciate the help as I'm quickly realizing this is a pretty
non-standard feature that I'm trying to get here.

Kind Regards,
Wael Karram.

On Wed, 4 Feb 2026 18:17:06 +0000
Nick Howitt via Fail2ban-users <fai...@li...>
wrote:

> I don't use zsh, but your script runs on in bash.
> 
> I have a number of comments.
> - If the system is invoking the script, does it inherit the PATH 
> variable? With a bash shebang you can do "#!/bin/bash -l" and root's 
> PATH will be honoured if running with root. Certainly this can be a 
> problem with cron jobs.
> - Why do you not prefer CIDR over converting Netrange to CIDR?
> - Instead of grep -o -E '([0-9]{1,3}[\.]){3}[0-9]{1,3} - 
> ([0-9]{1,3}[\.]){3}[0-9]{1,3}', I prefer awk '{print $2 $3 $4}'
> - something similar for grep -o -E
> '([0-9]{1,3}[\.]){3}[0-9]{1,3}/[0-9]{2}'
> - In your if statement, for your CIDR line you can directly do
> `iptables -w -I INPUT -s $(grep CIDR /root/njh/ban_range_data | awk
> '{print $2}') -m comment --comment "Ban $1" -j DROP`. Check which is
> the correct chain for you, remembering that f2b does not create the
> chain until it needs it.
> - You can do something similar for your NetRange.
> - Note I've added a comment to the iptables rule with the original IP 
> that was being detected. This can aid an unban action by doing
> something like iptables -nvL INPUT --line-numbers | grep "Ban $1" |
> awk '{print $1}' and, if the line exists in iptables, delete it by
> line number
> - Really, you have no need to use an intermediate file,
> ban_range_data, I'd have thought. Just shove the results into a
> variable.
> - Would it be safer to grep for ^CIDR and not just CIDR
> 
> On 04/02/2026 16:43, Wael Karram via Fail2ban-users wrote:
> > Indeed I am using iptables, but I couldn't get that to work, again
> > something funky going on with text substitution
> >
> > This is partly why I put the question on the mailing list, because
> > after two hours of trying to figure it out and looking it up online
> > I kind of gave up.
> >
> >
> >
> > On 2/4/26 6:14 PM, Nick Howitt via Fail2ban-users wrote:
> > Assuming you are using iptables, why not do iptables commands
> > directly at the end of your script? The same similarly goes for
> > other firewalls such as UFW (which uses iptables in the
> > background).  
> >> On 04/02/2026 10:55, Wael Karram via Fail2ban-users wrote:
> >> That I have gotten to work quite reliably well.  
> >>> Where I'm having problems is actually automating the ban action.
> >>>
> >>> I tried for example this line:
> >>> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh <ip> | ifne
> >>> xargs -I {} -n1 fail2ban-client set <name> banip {}
> >>>
> >>> But then I get an error with the substitution in the xargs command
> >>> not happening.
> >>>
> >>>
> >>> To overcome that I tried to package everything into a script as
> >>> follows: #!/bin/zsh
> >>> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh $1 | xargs -n1
> >>> sudo fail2ban-client -v set $2 banip And while running that
> >>> command manually on an interactive shell works, it fails in the
> >>> context of a script.
> >>>
> >>> It seems that something is wrong with the parameter passing - the
> >>> fail2ban-client command simply gets stuck waiting for input, I
> >>> even tried hard-coding the jail name and that clearly isn't what
> >>> is causing the issue (still gets stuck the same).
> >>>
> >>> Weirdly, if I keep the same structure and replace the
> >>> fail2ban-client sub-command with echo, I do get the value passed
> >>> through the pipe.
> >>>
> >>>
> >>> Kind Regards,
> >>>
> >>> Wael Karram.
> >>>
> >>>
> >>> On 2/3/26 6:02 PM, Nick Howitt via Fail2ban-users wrote:
> >>> Note that different registries return different fields. Try "whois
> >>> 82.5.79.245" where the address range is in a field called
> >>> "inetnum". You could try an ASN lookup then look up all the
> >>> ranges associated  
> >>>> with the ASN, but you'g end up with huge blocks.
> >>>>
> >>>>  From your script, you'd then have to generate the relevant
> >>>> iptables commands for the ban and unban actions.
> >>>>
> >>>> Nick
> >>>>
> >>>> On 03/02/2026 11:55, Wael Karram via Fail2ban-users wrote:
> >>>> Hello,
> >>>> I've noticed lately that my server is being loaded by many
> >>>> automated  
> >>>>> scanners and scrapers, I've got some nginx and opensmtpd
> >>>>> filters in place which can reliably catch them, though I've
> >>>>> also noticed that there are entire ASNs usually associated with
> >>>>> them.
> >>>>>
> >>>>> Currently, I am banning them manually more or less - once a day
> >>>>> I check the logs, look for any suspect lines and then lookup the
> >>>>> CIDRs and ban manually.
> >>>>>
> >>>>> I would like to automate this, though I'm somewhat stuck with
> >>>>> how to implement the action (the filter is actually the easy
> >>>>> part). All I've managed to come up with for now is this script:
> >>>>> http://0x0.st/Pb4E.sh
> >>>>> It takes an IP address and spits out the CIDRs of its ASN/the
> >>>>> entire range associated with it - line by line.
> >>>>>
> >>>>> I hope someone can help me on how to integrate this into a
> >>>>> custom ban action.
> >>>>>
> >>>>>
> >>>>>
> >>>>> _______________________________________________
> >>>>> Fail2ban-users mailing list
> >>>>> Fai...@li...
> >>>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> >>>>>
> >>>>> _______________________________________________  
> >>>> Fail2ban-users mailing list
> >>>> Fai...@li...
> >>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> >>>>
> >>>>
> >>>>
> >>>> _______________________________________________
> >>>> Fail2ban-users mailing list
> >>>> Fai...@li...
> >>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> >>>>  
> >>
> >> _______________________________________________
> >> Fail2ban-users mailing list
> >> Fai...@li...
> >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> >>
> >>
> >>
> >> _______________________________________________
> >> Fail2ban-users mailing list
> >> Fai...@li...
> >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users  



-- 
Kind Regards,
Wael Karram.

Re: [Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Nick H. <ni...@ho...>]

I don't use zsh, but your script runs on in bash.

I have a number of comments.
- If the system is invoking the script, does it inherit the PATH 
variable? With a bash shebang you can do "#!/bin/bash -l" and root's 
PATH will be honoured if running with root. Certainly this can be a 
problem with cron jobs.
- Why do you not prefer CIDR over converting Netrange to CIDR?
- Instead of grep -o -E '([0-9]{1,3}[\.]){3}[0-9]{1,3} - 
([0-9]{1,3}[\.]){3}[0-9]{1,3}', I prefer awk '{print $2 $3 $4}'
- something similar for grep -o -E '([0-9]{1,3}[\.]){3}[0-9]{1,3}/[0-9]{2}'
- In your if statement, for your CIDR line you can directly do `iptables 
-w -I INPUT -s $(grep CIDR /root/njh/ban_range_data | awk '{print $2}') 
-m comment --comment "Ban $1" -j DROP`. Check which is the correct chain 
for you, remembering that f2b does not create the chain until it needs it.
- You can do something similar for your NetRange.
- Note I've added a comment to the iptables rule with the original IP 
that was being detected. This can aid an unban action by doing something 
like iptables -nvL INPUT --line-numbers | grep "Ban $1" | awk '{print 
$1}' and, if the line exists in iptables, delete it by line number
- Really, you have no need to use an intermediate file, ban_range_data, 
I'd have thought. Just shove the results into a variable.
- Would it be safer to grep for ^CIDR and not just CIDR

On 04/02/2026 16:43, Wael Karram via Fail2ban-users wrote:
> Indeed I am using iptables, but I couldn't get that to work, again
> something funky going on with text substitution
>
> This is partly why I put the question on the mailing list, because
> after two hours of trying to figure it out and looking it up online I
> kind of gave up.
>
>
>
> On 2/4/26 6:14 PM, Nick Howitt via Fail2ban-users wrote:
> Assuming you are using iptables, why not do iptables commands directly
> at the end of your script? The same similarly goes for other firewalls
> such as UFW (which uses iptables in the background).
>> On 04/02/2026 10:55, Wael Karram via Fail2ban-users wrote:
>> That I have gotten to work quite reliably well.
>>> Where I'm having problems is actually automating the ban action.
>>>
>>> I tried for example this line:
>>> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh <ip> | ifne xargs
>>> -I {} -n1 fail2ban-client set <name> banip {}
>>>
>>> But then I get an error with the substitution in the xargs command
>>> not happening.
>>>
>>>
>>> To overcome that I tried to package everything into a script as
>>> follows: #!/bin/zsh
>>> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh $1 | xargs -n1
>>> sudo fail2ban-client -v set $2 banip And while running that command
>>> manually on an interactive shell works, it fails in the context of a
>>> script.
>>>
>>> It seems that something is wrong with the parameter passing - the
>>> fail2ban-client command simply gets stuck waiting for input, I even
>>> tried hard-coding the jail name and that clearly isn't what is
>>> causing the issue (still gets stuck the same).
>>>
>>> Weirdly, if I keep the same structure and replace the fail2ban-client
>>> sub-command with echo, I do get the value passed through the pipe.
>>>
>>>
>>> Kind Regards,
>>>
>>> Wael Karram.
>>>
>>>
>>> On 2/3/26 6:02 PM, Nick Howitt via Fail2ban-users wrote:
>>> Note that different registries return different fields. Try "whois
>>> 82.5.79.245" where the address range is in a field called "inetnum".
>>> You could try an ASN lookup then look up all the ranges associated
>>>> with the ASN, but you'g end up with huge blocks.
>>>>
>>>>  From your script, you'd then have to generate the relevant iptables
>>>> commands for the ban and unban actions.
>>>>
>>>> Nick
>>>>
>>>> On 03/02/2026 11:55, Wael Karram via Fail2ban-users wrote:
>>>> Hello,
>>>> I've noticed lately that my server is being loaded by many automated
>>>>> scanners and scrapers, I've got some nginx and opensmtpd filters in
>>>>> place which can reliably catch them, though I've also noticed that
>>>>> there are entire ASNs usually associated with them.
>>>>>
>>>>> Currently, I am banning them manually more or less - once a day I
>>>>> check the logs, look for any suspect lines and then lookup the
>>>>> CIDRs and ban manually.
>>>>>
>>>>> I would like to automate this, though I'm somewhat stuck with how
>>>>> to implement the action (the filter is actually the easy part).
>>>>> All I've managed to come up with for now is this script:
>>>>> http://0x0.st/Pb4E.sh
>>>>> It takes an IP address and spits out the CIDRs of its ASN/the
>>>>> entire range associated with it - line by line.
>>>>>
>>>>> I hope someone can help me on how to integrate this into a custom
>>>>> ban action.
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Fail2ban-users mailing list
>>>>> Fai...@li...
>>>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>>>
>>>>> _______________________________________________
>>>> Fail2ban-users mailing list
>>>> Fai...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Fail2ban-users mailing list
>>>> Fai...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>>
>>
>> _______________________________________________
>> Fail2ban-users mailing list
>> Fai...@li...
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>
>>
>>
>> _______________________________________________
>> Fail2ban-users mailing list
>> Fai...@li...
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users

Re: [Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Henry S. T. <ht...@ho...>]

I've shifted to using ipsets directly with fail2ban, without any code
to identify whole bad IP blocks such as you've done, although I do
think it's astonishing that so _many_ black-hat IP source addresses
are showing up yet no-one seems to be in a position to track them down
and put a stop to it (naive, I know :-(.

Since IP addresses are being used in rotation, I have to have the
relevant filters configured for only one fetch of a non-existent page
to trigger blacklisting.  My configuration has stablised at about 2.4
_million_ IPv4 and 660,000 IPv6 bad addresses, being flushed about
every 10 days and then refilled by f2b.  Using ipset and managing it
separately avoids the huge cost of flushing fail2ban itself, but I
still see one f2b thread running pretty much continuously.

I started writing up my setup in order to share it, but other tasks
got in the way, I'll try to get back to that...

ht
-- 
Henry S. Thompson

Re: [Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Wael K. <wa...@wa...>]

Indeed I am using iptables, but I couldn't get that to work, again
something funky going on with text substitution

This is partly why I put the question on the mailing list, because
after two hours of trying to figure it out and looking it up online I
kind of gave up.



On 2/4/26 6:14 PM, Nick Howitt via Fail2ban-users wrote:
Assuming you are using iptables, why not do iptables commands directly
at the end of your script? The same similarly goes for other firewalls
such as UFW (which uses iptables in the background).
> 
> On 04/02/2026 10:55, Wael Karram via Fail2ban-users wrote:
> That I have gotten to work quite reliably well.
>> 
>> Where I'm having problems is actually automating the ban action.
>> 
>> I tried for example this line:
>> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh <ip> | ifne xargs
>> -I {} -n1 fail2ban-client set <name> banip {}
>> 
>> But then I get an error with the substitution in the xargs command
>> not happening.
>> 
>> 
>> To overcome that I tried to package everything into a script as
>> follows: #!/bin/zsh
>> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh $1 | xargs -n1
>> sudo fail2ban-client -v set $2 banip And while running that command
>> manually on an interactive shell works, it fails in the context of a
>> script.
>> 
>> It seems that something is wrong with the parameter passing - the
>> fail2ban-client command simply gets stuck waiting for input, I even
>> tried hard-coding the jail name and that clearly isn't what is
>> causing the issue (still gets stuck the same).
>> 
>> Weirdly, if I keep the same structure and replace the fail2ban-client
>> sub-command with echo, I do get the value passed through the pipe.
>> 
>> 
>> Kind Regards,
>> 
>> Wael Karram.
>> 
>> 
>> On 2/3/26 6:02 PM, Nick Howitt via Fail2ban-users wrote:
>> Note that different registries return different fields. Try "whois
>> 82.5.79.245" where the address range is in a field called "inetnum".
>> You could try an ASN lookup then look up all the ranges associated
>>> with the ASN, but you'g end up with huge blocks.
>>> 
>>> From your script, you'd then have to generate the relevant iptables
>>> commands for the ban and unban actions.
>>> 
>>> Nick
>>> 
>>> On 03/02/2026 11:55, Wael Karram via Fail2ban-users wrote:
>>> Hello,
>>> I've noticed lately that my server is being loaded by many automated
>>>> scanners and scrapers, I've got some nginx and opensmtpd filters in
>>>> place which can reliably catch them, though I've also noticed that
>>>> there are entire ASNs usually associated with them.
>>>> 
>>>> Currently, I am banning them manually more or less - once a day I
>>>> check the logs, look for any suspect lines and then lookup the
>>>> CIDRs and ban manually.
>>>> 
>>>> I would like to automate this, though I'm somewhat stuck with how
>>>> to implement the action (the filter is actually the easy part).
>>>> All I've managed to come up with for now is this script:
>>>> http://0x0.st/Pb4E.sh
>>>> It takes an IP address and spits out the CIDRs of its ASN/the
>>>> entire range associated with it - line by line.
>>>> 
>>>> I hope someone can help me on how to integrate this into a custom
>>>> ban action.
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> Fail2ban-users mailing list
>>>> Fai...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>> 
>>>> _______________________________________________
>>> Fail2ban-users mailing list
>>> Fai...@li...
>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> Fail2ban-users mailing list
>>> Fai...@li...
>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>> 
> 
> 
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> 

Re: [Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Nick H. <ni...@ho...>]

Assuming you are using iptables, why not do iptables commands directly 
at the end of your script? The same similarly goes for other firewalls 
such as UFW (which uses iptables in the background).

On 04/02/2026 10:55, Wael Karram via Fail2ban-users wrote:
> That I have gotten to work quite reliably well.
>
> Where I'm having problems is actually automating the ban action.
>
> I tried for example this line:
> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh <ip> | ifne xargs
> -I {} -n1 fail2ban-client set <name> banip {}
>
> But then I get an error with the substitution in the xargs command not
> happening.
>
>
> To overcome that I tried to package everything into a script as follows:
> #!/bin/zsh
> /etc/fail2ban/scripts/generate_ban_range_from_ip.sh $1 | xargs -n1 sudo
> fail2ban-client -v set $2 banip And while running that command manually
> on an interactive shell works, it fails in the context of a script.
>
> It seems that something is wrong with the parameter passing - the
> fail2ban-client command simply gets stuck waiting for input, I even
> tried hard-coding the jail name and that clearly isn't what is causing
> the issue (still gets stuck the same).
>
> Weirdly, if I keep the same structure and replace the fail2ban-client
> sub-command with echo, I do get the value passed through the pipe.
>
>
> Kind Regards,
>
> Wael Karram.
>
>
> On 2/3/26 6:02 PM, Nick Howitt via Fail2ban-users wrote:
> Note that different registries return different fields. Try "whois
> 82.5.79.245" where the address range is in a field called "inetnum".
>> You could try an ASN lookup then look up all the ranges associated
>> with the ASN, but you'g end up with huge blocks.
>>
>>  From your script, you'd then have to generate the relevant iptables
>> commands for the ban and unban actions.
>>
>> Nick
>>
>> On 03/02/2026 11:55, Wael Karram via Fail2ban-users wrote:
>> Hello,
>>> I've noticed lately that my server is being loaded by many automated
>>> scanners and scrapers, I've got some nginx and opensmtpd filters in
>>> place which can reliably catch them, though I've also noticed that
>>> there are entire ASNs usually associated with them.
>>>
>>> Currently, I am banning them manually more or less - once a day I
>>> check the logs, look for any suspect lines and then lookup the CIDRs
>>> and ban manually.
>>>
>>> I would like to automate this, though I'm somewhat stuck with how to
>>> implement the action (the filter is actually the easy part).
>>> All I've managed to come up with for now is this script:
>>> http://0x0.st/Pb4E.sh
>>> It takes an IP address and spits out the CIDRs of its ASN/the entire
>>> range associated with it - line by line.
>>>
>>> I hope someone can help me on how to integrate this into a custom ban
>>> action.
>>>
>>>
>>>
>>> _______________________________________________
>>> Fail2ban-users mailing list
>>> Fai...@li...
>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>
>>
>> _______________________________________________
>> Fail2ban-users mailing list
>> Fai...@li...
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>
>>
>>
>> _______________________________________________
>> Fail2ban-users mailing list
>> Fai...@li...
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users

Re: [Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Wael K. <wa...@wa...>]

That I have gotten to work quite reliably well.

Where I'm having problems is actually automating the ban action.

I tried for example this line:
/etc/fail2ban/scripts/generate_ban_range_from_ip.sh <ip> | ifne xargs
-I {} -n1 fail2ban-client set <name> banip {}

But then I get an error with the substitution in the xargs command not
happening.


To overcome that I tried to package everything into a script as follows:
#!/bin/zsh
/etc/fail2ban/scripts/generate_ban_range_from_ip.sh $1 | xargs -n1 sudo
fail2ban-client -v set $2 banip And while running that command manually
on an interactive shell works, it fails in the context of a script.

It seems that something is wrong with the parameter passing - the
fail2ban-client command simply gets stuck waiting for input, I even
tried hard-coding the jail name and that clearly isn't what is causing
the issue (still gets stuck the same).

Weirdly, if I keep the same structure and replace the fail2ban-client
sub-command with echo, I do get the value passed through the pipe.


Kind Regards,

Wael Karram.


On 2/3/26 6:02 PM, Nick Howitt via Fail2ban-users wrote:
Note that different registries return different fields. Try "whois
82.5.79.245" where the address range is in a field called "inetnum".
> 
> You could try an ASN lookup then look up all the ranges associated
> with the ASN, but you'g end up with huge blocks.
> 
> From your script, you'd then have to generate the relevant iptables
> commands for the ban and unban actions.
> 
> Nick
> 
> On 03/02/2026 11:55, Wael Karram via Fail2ban-users wrote:
> Hello,
>> I've noticed lately that my server is being loaded by many automated
>> scanners and scrapers, I've got some nginx and opensmtpd filters in
>> place which can reliably catch them, though I've also noticed that
>> there are entire ASNs usually associated with them.
>> 
>> Currently, I am banning them manually more or less - once a day I
>> check the logs, look for any suspect lines and then lookup the CIDRs
>> and ban manually.
>> 
>> I would like to automate this, though I'm somewhat stuck with how to
>> implement the action (the filter is actually the easy part).
>> All I've managed to come up with for now is this script:
>> http://0x0.st/Pb4E.sh
>> It takes an IP address and spits out the CIDRs of its ASN/the entire
>> range associated with it - line by line.
>> 
>> I hope someone can help me on how to integrate this into a custom ban
>> action.
>> 
>> 
>> 
>> _______________________________________________
>> Fail2ban-users mailing list
>> Fai...@li...
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>> 
> 
> 
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> 

Re: [Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Nick H. <ni...@ho...>]

Note that different registries return different fields. Try "whois 
82.5.79.245" where the address range is in a field called "inetnum".

You could try an ASN lookup then look up all the ranges associated with 
the ASN, but you'g end up with huge blocks.

 From your script, you'd then have to generate the relevant iptables 
commands for the ban and unban actions.

Nick

On 03/02/2026 11:55, Wael Karram via Fail2ban-users wrote:
> Hello,
> I've noticed lately that my server is being loaded by many automated
> scanners and scrapers, I've got some nginx and opensmtpd filters in
> place which can reliably catch them, though I've also noticed that
> there are entire ASNs usually associated with them.
>
> Currently, I am banning them manually more or less - once a day I check
> the logs, look for any suspect lines and then lookup the CIDRs and ban
> manually.
>
> I would like to automate this, though I'm somewhat stuck with how to
> implement the action (the filter is actually the easy part).
> All I've managed to come up with for now is this script:
> http://0x0.st/Pb4E.sh
> It takes an IP address and spits out the CIDRs of its ASN/the entire
> range associated with it - line by line.
>
> I hope someone can help me on how to integrate this into a custom ban
> action.
>
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users

[Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Wael K. <wa...@wa...>]

Hello,
I've noticed lately that my server is being loaded by many automated
scanners and scrapers, I've got some nginx and opensmtpd filters in
place which can reliably catch them, though I've also noticed that
there are entire ASNs usually associated with them.

Currently, I am banning them manually more or less - once a day I check
the logs, look for any suspect lines and then lookup the CIDRs and ban
manually.

I would like to automate this, though I'm somewhat stuck with how to
implement the action (the filter is actually the easy part).
All I've managed to come up with for now is this script:
http://0x0.st/Pb4E.sh
It takes an IP address and spits out the CIDRs of its ASN/the entire
range associated with it - line by line.

I hope someone can help me on how to integrate this into a custom ban
action.

-- 
Kind Regards,
Wael Karram.

[Fail2ban-users] Custom Ban Action, Shell Script, CIDR

[Wael K. <wa...@wa...>]

Hello,
I've noticed lately that my server is being loaded by many automated
scanners and scrapers, I've got some nginx and opensmtpd filters in
place which can reliably catch them, though I've also noticed that
there are entire ASNs usually associated with them.

Currently, I am banning them manually more or less - once a day I check
the logs, look for any suspect lines and then lookup the CIDRs and ban
manually.

I would like to automate this, though I'm somewhat stuck with how to
implement the action (the filter is actually the easy part).
All I've managed to come up with for now is this script:
http://0x0.st/Pb4E.sh
It takes an IP address and spits out the CIDRs of its ASN/the entire
range associated with it - line by line.

I hope someone can help me on how to integrate this into a custom ban
action.

-- 
Kind Regards,
Wael Karram.

[Fail2ban-users] Can you use action tags in regex

[George W. <ge...@gr...>]

Is it possible to use action tags in a regex?

In particular, I would like to be able to match the local host's name in a regex.  Suppose log lines look like this:

Oct 05 08:14:08 myhostname mydaemon[12345]: Nasty behavior from 192.168.1.1 port 56789

For the filter for this daemon, this works:

prefregex = myhostname mydaemon\[\d+\]:[ ]
failregex = Nasty behavior from <ADDR>

But I have multiple machines and I would like a filter that does not have to be customized for each one.  So I tried this:

prefregex = <sh-hostname> mydaemon\[\d+\]:[ ]

but that does not work.  So, is there a way to use the <sh-hostname> tag in a regex?  Is there some other way to match the local hostname?

Thanks.

Re: [Fail2ban-users] froxlor

[Dudi G. <du...@ko...>]

Hi,

I have both options covered in the working filter.

Regards,
Dudi

-----Original Message-----
From: Nick Howitt via Fail2ban-users <fai...@li...> 
Sent: Monday, 22 September, 2025 12:14 PM
To: fai...@li...
Subject: Re: [Fail2ban-users] froxlor

Or, perhaps simpler:
WARNING: Unknown user tried to login.*"<HOST>"

On 22/09/2025 09:22, Dudi Goldenberg wrote:
> Thank you.
>
> I'll investigate.
>
> Regards,
> Dudi
>
> -----Original Message-----
> From: Tim Boneko via Fail2ban-users <fai...@li...>
> Sent: Monday, 22 September, 2025 11:18 AM
> To: fai...@li...
> Subject: Re: [Fail2ban-users] froxlor
>
> That's one ugly regex which is too long for a single line like it should be:
>
> froxlor\.WARNING: Unknown user tried to login\.
> {"source":"login","action":"50","user":"<HOST>"\} \[\]
>
> ...but it matches here. I only escaped special characters for Perl, i.e. these ones: . ( ) [ ] { } by putting a \ directly before them.
> Feel free to modify to your needs.
> Cheers,
>
> 	tim
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users



_______________________________________________
Fail2ban-users mailing list
Fai...@li...
https://lists.sourceforge.net/lists/listinfo/fail2ban-users

Re: [Fail2ban-users] froxlor

[Nick H. <ni...@ho...>]

Or, perhaps simpler:
WARNING: Unknown user tried to login.*"<HOST>"

On 22/09/2025 09:22, Dudi Goldenberg wrote:
> Thank you.
>
> I'll investigate.
>
> Regards,
> Dudi
>
> -----Original Message-----
> From: Tim Boneko via Fail2ban-users <fai...@li...>
> Sent: Monday, 22 September, 2025 11:18 AM
> To: fai...@li...
> Subject: Re: [Fail2ban-users] froxlor
>
> That's one ugly regex which is too long for a single line like it should be:
>
> froxlor\.WARNING: Unknown user tried to login\.
> {"source":"login","action":"50","user":"<HOST>"\} \[\]
>
> ...but it matches here. I only escaped special characters for Perl, i.e. these ones: . ( ) [ ] { } by putting a \ directly before them.
> Feel free to modify to your needs.
> Cheers,
>
> 	tim
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users

Re: [Fail2ban-users] froxlor

[Dudi G. <du...@ko...>]

Thank you.

I'll investigate.

Regards,
Dudi

-----Original Message-----
From: Tim Boneko via Fail2ban-users <fai...@li...> 
Sent: Monday, 22 September, 2025 11:18 AM
To: fai...@li...
Subject: Re: [Fail2ban-users] froxlor

That's one ugly regex which is too long for a single line like it should be:

froxlor\.WARNING: Unknown user tried to login\.
{"source":"login","action":"50","user":"<HOST>"\} \[\]

...but it matches here. I only escaped special characters for Perl, i.e. these ones: . ( ) [ ] { } by putting a \ directly before them.
Feel free to modify to your needs. 
Cheers,

	tim


_______________________________________________
Fail2ban-users mailing list
Fai...@li...
https://lists.sourceforge.net/lists/listinfo/fail2ban-users

Re: [Fail2ban-users] froxlor

[Tim B. <ti...@bo...>]

That's one ugly regex which is too long for a single line like it
should be:

froxlor\.WARNING: Unknown user tried to login\.
{"source":"login","action":"50","user":"<HOST>"\} \[\]

...but it matches here. I only escaped special characters for Perl,
i.e. these ones: . ( ) [ ] { } by putting a \ directly before them.
Feel free to modify to your needs. 
Cheers,

	tim

Re: [Fail2ban-users] froxlor

[Dudi G. <du...@ko...>]

-----Original Message-----
From: Tim Boneko via Fail2ban-users <fai...@li...> 
Sent: Sunday, 21 September, 2025 11:09 AM
To: fai...@li...
Subject: Re: [Fail2ban-users] froxlor

Am Samstag, dem 20.09.2025 um 16:49 +0000 schrieb Dudi Goldenberg:
>  
> Sep 20 14:44:52 hostname froxlor[181107]: froxlor.WARNING: Unknown 
> user tried to login.
> {"source":"login","action":"50","user":"141.226.1.2"} []

That's one ugly log line.
Agreed.

 Do you have a possibility to change the formatting of the log line? Maybe point log output towards journal?
I just checked, journalctl shows the exact same syntax, and I have no control of the logging there, apart from log filenames etc.

I'll have another shot at a new regex, but this will grey out the little hair I have left, and it will be ugly 😊

I'd rather have someone better at this then me do this.

Cheers,

	tim

Regards,
Dudi
_______________________________________________
Fail2ban-users mailing list
Fai...@li...
https://lists.sourceforge.net/lists/listinfo/fail2ban-users

Re: [Fail2ban-users] froxlor

[Tim B. <ti...@bo...>]

Am Samstag, dem 20.09.2025 um 16:49 +0000 schrieb Dudi Goldenberg:
>  
> Sep 20 14:44:52 hostname froxlor[181107]: froxlor.WARNING: Unknown
> user tried to login.
> {"source":"login","action":"50","user":"141.226.1.2"} []

That's one ugly log line. Do you have a possibility to change the
formatting of the log line? Maybe point log output towards journal?
Cheers,

	tim

[Fail2ban-users] froxlor

[Dudi G. <du...@ko...>]

Hello list,

Debian 12 ships with Fail2Ban v1.0.2 which has a froxlor-auth.conf filter that does not detect failures.

This is a sample fail line from syslog, I tried to build a new regex but didn't get very far...

Sep 20 14:44:52 hostname froxlor[181107]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":"141.226.1.2"} []

Help appreciated.

TIA & regards,
Dudi

[Fail2ban-users] iptables entry not effective

[Hans-Christian K. <hc...@sc...>]

Hello,

I'm running Fail2ban on Unraid inside a Docker container (with --network host). There are various other containers (e.g. nginx proxy manager, running in custom network br0 or jellyfin running in custom network dnet).
Fail2ban successfully adds rules to the host's iptables-legacy, but access to my Jellyfin container is still possible from banned IPs. The external IPs are redirected from npm and can be seen in the access logs of jellyfin.

Host: Unraid (iptables-legacy)
Setup: Docker with several containers, Jellyfin exposed with
Fail2ban: running as Docker container with --cap-add=NET_ADMIN --cap-add=NET_RAW, network mode host
Action: iptables-allports[name=jellyfin, chain=INPUT, iptables=iptables-legacy]

Rules are definitely inserted, but I think my iptables is messed up. I already tried chain=DOCKER-USER or chain=FORWARD etc.

Attached the table after a ban:

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
f2b-jellyfin  tcp  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
f2b-jellyfin  all  --  anywhere             anywhere
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
WIREGUARD  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (3 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.20.0.2           tcp dpt:8000
ACCEPT     tcp  --  anywhere             172.20.0.3           tcp dpt:5055
ACCEPT     tcp  --  anywhere             172.20.0.2           tcp dpt:8080
ACCEPT     tcp  --  anywhere             172.20.0.2           tcp dpt:8888
ACCEPT     tcp  --  anywhere             172.20.0.5           tcp dpt:7878
ACCEPT     tcp  --  anywhere             172.20.0.6           tcp dpt:8989
ACCEPT     tcp  --  anywhere             172.20.0.7           tcp dpt:5005
ACCEPT     tcp  --  anywhere             172.20.0.7           tcp dpt:5006
ACCEPT     tcp  --  anywhere             172.20.0.32          tcp dpt:3000
ACCEPT     tcp  --  anywhere             172.20.0.32          tcp dpt:8080
ACCEPT     tcp  --  anywhere             172.20.0.31          tcp dpt:commplex-main
ACCEPT     udp  --  anywhere             172.20.0.4           udp dpt:1900
ACCEPT     udp  --  anywhere             172.20.0.4           udp dpt:7359
ACCEPT     tcp  --  anywhere             172.20.0.4           tcp dpt:8096
ACCEPT     tcp  --  anywhere             172.20.0.4           tcp dpt:8920

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain WIREGUARD (1 references)
target     prot opt source               destination

Chain f2b-jellyfin (2 references)
target     prot opt source               destination
REJECT     all  --  tmo-125-252.customers.d1-online.com  anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere

Thanks,
Hans

[Fail2ban-users] nginx filters for journald logs

[roughnecks <rou...@wo...>]

Hallo,

I have a Debian bookworm VPS, which was upgraded from bullseye when the 
former came out.

Lately I moved my nginx logs from files in /var/log to syslog (journal).
The only info i was able to find to make the change, was:

```
access_log syslog:server=unix:/dev/log;
error_log syslog:server=unix:/dev/log;
```

and it's actually logging to `nginx.service`, but I think that logs have 
a different format now and fail2ban's filters are not working anymore.

I found a few closed issues on github, but some update filters in there 
are making f2b crash at startup, so I would need assistance.

I'm trying to attach here all of the 4 filters I have at the moment, 
hopefully they'll be sent over.

An example log from journal is:

Sep 07 21:20:43 pandora.sub.domain nginx[23141]: pandora.sub.domain 
nginx: 2025/09/07 21:20:40 [error] 23141#23141: *24470 PAM: us
er 'username' - not authenticated: Authentication failure, client: 
31.187.12.120, server: webdav.sub.domain, request: "GET / HTTP/2.0", hos
t: "webdav.sub.domain"

Can you help? Thanks!

-- 
roughnecks