Re: [Fail2ban-users] No one banned, ports block

[Charles D. <cde...@gm...>]

On 7/17/26 3:36 PM, Tom Moore via Fail2ban-users wrote:
> Hi
> 
> I am trying to set up fail2ban on Awslinux 2023 (which is a fedora spin) 
> on EC2.  To start with, the service that I am trying to protect is 
> running and I can connect to it from the outside world on a port in the 
> 7000 range.  I then install fail2ban and start it out of the box with no 
> local changes.  At this point, freshly installed, I can still reach the 
> port from the outside world.
> 
> If I reboot the instance, my port is now unreachable from the outside.  
> Note that I did not enable fail2ban as a service, so it is not even 
> running in the rebooted instance.  If I start or stop fail2ban nothing 
> changes, at this point the port seems blocked.
> 
> If I uninstall fail2ban (dnf remove fail2ban) then the port is 
> accessible again.
> 
> Note that this is with no changes to the config files, just plain out of 
> the box.
> 
> Does anyone have an idea of what is going wrong here?  If seems to work 
> ok initially, but after the first reboot the port is blocked.  Ssh still 
> works, so it is not like all ports are blocked.  I do notice that some 
> of the aws ec2 monitoring is not reporting, so perhaps other ports are 
> blocked as well.
> 
> Thanks,
> Tom

Tom,

I use f2b to keep the bad players out of my apache web server that I run 
on my home system and those who happen to find my hidden sshd port. 
While I don't know what your specific problem is, I can offer a few 
suggestions on debugging it.   My system run Fedora 44.  I don't know 
how similar it is to your system.

I'm going to assume for a system log you use journald.  If not that then 
perhaps all log messages go to /var/log/messages.  Wherever it is, you 
want to watch that.  Open up a terminal window.  For journald, you can 
run "journalctl -f" which will tail the journal log.  Or "tail -f 
/var/log/messages" to tail that file.  On my system I see a log entry 
when an IP address is blocked. F2b also has it's own log file at 
/var/log/fail2ban which you can also keep an eye on.

Assuming f2b was set up to use iptables to block things, one command you 
can run to see what iptables has in it is "sudo iptables-save" which 
will show everything in iptables to stdout.   You might also want to 
take a look at /etc/sysconfig/iptables.  It's a text file that is used 
to start iptables.  F2b should not have written to that file but maybe 
something got added to it somehow.  F2b adds to the memory resident 
iptables as it runs and not to any config file.  It does keep a database 
of what it's banned so that when it restarts it can reban sites that 
were banned when it was restarted.

This should get you started unless someone else knows more than I do and 
has a better suggestion.

Charlie