Home / server / Questions / 1148593
Accepted
Ami Heines
Asked: 2023-11-26 20:44:42 +0800 CST

fail2ban ignores <HOST> IP address and bans all incoming traffic

  • 772

I'm trying to enable fail2ban on Centos 7 with Apache. I have an app which writes to the error log a specific string when login fails.

responds with the right IP address in the Banned IP list,

> fail2ban-client status appname
Status for the jail: appname
|- Filter
|  |- Currently failed: 1
|  |- Total failed: 7
|  `- File list:    /var/log/httpd/api.appname-error.log
`- Actions
   |- Currently banned: 1
   |- Total banned: 3
   `- Banned IP list:   10.50.0.68

But when I look in the iptables I see it blocks all incoming traffic in line 1 which corresponds to my app, EDITED: added more detailed iptables at bottom of question

> iptables -L INPUT --line-numbers 
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     tcp  --  anywhere             anywhere             multiport dports https,http match-set f2b-appname src reject-with icmp-port-unreachable
2    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
3    ACCEPT     all  --  anywhere             anywhere            
4    INPUT_direct  all  --  anywhere             anywhere            
5    INPUT_ZONES_SOURCE  all  --  anywhere             anywhere            
6    INPUT_ZONES  all  --  anywhere             anywhere            
7    DROP       all  --  anywhere             anywhere             ctstate INVALID
8    REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Here is my filter, /etc/fail2ban/filter.d/appname.conf:

[Definition]
failregex = client <HOST>(.*)fail2ban\-appname\-login\-fail

The jail.local is short:

[DEFAULT]
bantime = 1200
findtime = 3600
maxmatches = 4

[appname]
enabled  = true
filter   = appname
action   = iptables-ipset-proto6[name=appname, port="https,http", protocol=tcp]
logpath  = /var/log/httpd/api.appname-error.log
maxretry = 3
mode     = normal
backend  = auto

And a typical line from the apache php log file:

[Sun Nov 26 10:22:31.255875 2023] [php7:notice] [pid 1837] [client 10.50.0.68:36530] fail2ban-appname-login-fail

A more detailed iptables output:

> sudo iptables-save -c

# Generated by iptables-save v1.4.21 on Mon Nov 27 07:42:05 2023
*nat
:PREROUTING ACCEPT [18229:1086560]
:INPUT ACCEPT [17668:1053268]
:OUTPUT ACCEPT [10696:675656]
:POSTROUTING ACCEPT [10696:675656]
:OUTPUT_direct - [0:0]
:POSTROUTING_ZONES - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING_direct - [0:0]
:POST_public - [0:0]
:POST_public_allow - [0:0]
:POST_public_deny - [0:0]
:POST_public_log - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
[18230:1087136] -A PREROUTING -j PREROUTING_direct
[18230:1087136] -A PREROUTING -j PREROUTING_ZONES_SOURCE
[18230:1087136] -A PREROUTING -j PREROUTING_ZONES
[10696:675656] -A OUTPUT -j OUTPUT_direct
[10696:675656] -A POSTROUTING -j POSTROUTING_direct
[10696:675656] -A POSTROUTING -j POSTROUTING_ZONES_SOURCE
[10696:675656] -A POSTROUTING -j POSTROUTING_ZONES
[2972:212273] -A POSTROUTING_ZONES -o eth0 -g POST_public
[7724:463383] -A POSTROUTING_ZONES -g POST_public
[10696:675656] -A POST_public -j POST_public_log
[10696:675656] -A POST_public -j POST_public_deny
[10696:675656] -A POST_public -j POST_public_allow
[18229:1086560] -A PREROUTING_ZONES -i eth0 -g PRE_public
[1:576] -A PREROUTING_ZONES -g PRE_public
[18230:1087136] -A PRE_public -j PRE_public_log
[18230:1087136] -A PRE_public -j PRE_public_deny
[18230:1087136] -A PRE_public -j PRE_public_allow
COMMIT
# Completed on Mon Nov 27 07:42:05 2023
# Generated by iptables-save v1.4.21 on Mon Nov 27 07:42:05 2023
*mangle
:PREROUTING ACCEPT [315975:53668565]
:INPUT ACCEPT [315975:53668565]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [301701:219207592]
:POSTROUTING ACCEPT [301701:219207592]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
[315976:53669141] -A PREROUTING -j PREROUTING_direct
[315976:53669141] -A PREROUTING -j PREROUTING_ZONES_SOURCE
[315976:53669141] -A PREROUTING -j PREROUTING_ZONES
[315975:53668565] -A INPUT -j INPUT_direct
[0:0] -A FORWARD -j FORWARD_direct
[301701:219207592] -A OUTPUT -j OUTPUT_direct
[301701:219207592] -A POSTROUTING -j POSTROUTING_direct
[170984:20172057] -A PREROUTING_ZONES -i eth0 -g PRE_public
[144992:33497084] -A PREROUTING_ZONES -g PRE_public
[315976:53669141] -A PRE_public -j PRE_public_log
[315976:53669141] -A PRE_public -j PRE_public_deny
[315976:53669141] -A PRE_public -j PRE_public_allow
COMMIT
# Completed on Mon Nov 27 07:42:05 2023
# Generated by iptables-save v1.4.21 on Mon Nov 27 07:42:05 2023
*security
:INPUT ACCEPT [315132:53613699]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [301701:219207592]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
[315132:53613699] -A INPUT -j INPUT_direct
[0:0] -A FORWARD -j FORWARD_direct
[301701:219207592] -A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Mon Nov 27 07:42:05 2023
# Generated by iptables-save v1.4.21 on Mon Nov 27 07:42:05 2023
*raw
:PREROUTING ACCEPT [315975:53668565]
:OUTPUT ACCEPT [301701:219207592]
:OUTPUT_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
[315976:53669141] -A PREROUTING -j PREROUTING_direct
[315976:53669141] -A PREROUTING -j PREROUTING_ZONES_SOURCE
[315976:53669141] -A PREROUTING -j PREROUTING_ZONES
[301701:219207592] -A OUTPUT -j OUTPUT_direct
[170984:20172057] -A PREROUTING_ZONES -i eth0 -g PRE_public
[144992:33497084] -A PREROUTING_ZONES -g PRE_public
[315976:53669141] -A PRE_public -j PRE_public_log
[315976:53669141] -A PRE_public -j PRE_public_deny
[315976:53669141] -A PRE_public -j PRE_public_allow
COMMIT
# Completed on Mon Nov 27 07:42:05 2023
# Generated by iptables-save v1.4.21 on Mon Nov 27 07:42:05 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [132432:168012162]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_public - [0:0]
:FWDI_public_allow - [0:0]
:FWDI_public_deny - [0:0]
:FWDI_public_log - [0:0]
:FWDO_public - [0:0]
:FWDO_public_allow - [0:0]
:FWDO_public_deny - [0:0]
:FWDO_public_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
[459:26548] -A INPUT -p tcp -m multiport --dports 443,80 -m set --match-set f2b-appname src -j REJECT --reject-with icmp-port-unreachable
[289740:52097048] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[7724:463383] -A INPUT -i lo -j ACCEPT
[17676:1053754] -A INPUT -j INPUT_direct
[17676:1053754] -A INPUT -j INPUT_ZONES_SOURCE
[17676:1053754] -A INPUT -j INPUT_ZONES
[8:486] -A INPUT -m conntrack --ctstate INVALID -j DROP
[0:0] -A INPUT -j REJECT --reject-with icmp-host-prohibited
[0:0] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i lo -j ACCEPT
[0:0] -A FORWARD -j FORWARD_direct
[0:0] -A FORWARD -j FORWARD_IN_ZONES_SOURCE
[0:0] -A FORWARD -j FORWARD_IN_ZONES
[0:0] -A FORWARD -j FORWARD_OUT_ZONES_SOURCE
[0:0] -A FORWARD -j FORWARD_OUT_ZONES
[0:0] -A FORWARD -m conntrack --ctstate INVALID -j DROP
[0:0] -A FORWARD -j REJECT --reject-with icmp-host-prohibited
[144991:33496508] -A OUTPUT -o lo -j ACCEPT
[156710:185711084] -A OUTPUT -j OUTPUT_direct
[0:0] -A FORWARD_IN_ZONES -i eth0 -g FWDI_public
[0:0] -A FORWARD_IN_ZONES -g FWDI_public
[0:0] -A FORWARD_OUT_ZONES -o eth0 -g FWDO_public
[0:0] -A FORWARD_OUT_ZONES -g FWDO_public
[0:0] -A FWDI_public -j FWDI_public_log
[0:0] -A FWDI_public -j FWDI_public_deny
[0:0] -A FWDI_public -j FWDI_public_allow
[0:0] -A FWDI_public -p icmp -j ACCEPT
[0:0] -A FWDO_public -j FWDO_public_log
[0:0] -A FWDO_public -j FWDO_public_deny
[0:0] -A FWDO_public -j FWDO_public_allow
[17676:1053754] -A INPUT_ZONES -i eth0 -g IN_public
[0:0] -A INPUT_ZONES -g IN_public
[17676:1053754] -A IN_public -j IN_public_log
[17676:1053754] -A IN_public -j IN_public_deny
[17676:1053754] -A IN_public -j IN_public_allow
[0:0] -A IN_public -p icmp -j ACCEPT
[11:660] -A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,UNTRACKED -j ACCEPT
[17651:1052260] -A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW,UNTRACKED -j ACCEPT
[6:348] -A IN_public_allow -p tcp -m tcp --dport 3306 -m conntrack --ctstate NEW,UNTRACKED -j ACCEPT
COMMIT
# Completed on Mon Nov 27 07:42:05 2023

I was expecting the IP address to appear in the "source" of the iptables -L INPUT --line-numbers and was surprised to see "anywhere".

I don't understand, if fail2ban shows my IP address in the banned IP list, why doesn't it use only that IP address in the iptables?

How can I diagnose or correct this?

Thanks you!

iptables

1 Answers

  1. Best Answer

    The line:

    1    REJECT     tcp  --  anywhere             anywhere             multiport dports https,http match-set f2b-appname src reject-with icmp-port-unreachable

    is equivalent to:

    [459:26548] -A INPUT -p tcp -m multiport --dports 443,80 -m set --match-set f2b-appname src -j REJECT --reject-with icmp-port-unreachable

    If all the matches evaluate to true, then the target rule (introduced with -j) is performed. If any match evaluates to false, this stop the rule's processing before reaching the target rule, continuing to the next rule.

    Having an additional condition such as: "and also match any IP source address" which would be -s 0.0.0.0/0 or as "and also match any IP destination address" (-d 0.0.0.0/0) which are always true, doesn't change the outcome (with logical reasoning: (x AND true) <=> x). That's so common that although iptables (when it was still iptables-legacy) used to always store such source and destination information even with 0.0.0.0/0, it's not displayed back in ruleset outputs intended to be reproducible (iptables-save or iptables -S) but is still displayed as anywhere with iptables -L because there's a fixed column for such information anyway.

    What matters here is ipset seen in fail2ban's configuration:

    action   = iptables-ipset-proto6[name=appname, port="https,http", protocol=tcp]
logpath  = /var/log/httpd/api.appname-error.log

    which add IP addresses retrieved from logs (when conditions for such logs apply etc., usually errors)...

    ... and the associated -m set match module in iptables' rule. This rule tells that for incoming destination TCP ports 443 or 80 (else it won't go further) it will do a lookup for the source address in the ipset set f2b-appname and will evaluate to true if found, leading to the terminal (no further processing) REJECT target: the ban, or else continue to the next rule in the ruleset.

    That means fail2ban uses the command ipset to add IP entries to an IP set, which can then be checked (during packet path) by iptables which will react by rejecting any match.

    So to check what has been added run:

    ipset list

    or more precisely in case there were others:

    ipset list f2b-appname

    which should end with something similar to:

    Number of entries: 1
Members:
10.50.0.68

    Notes:

    • iptables-ipset-proto6 despite its name handles both IPv4 and IPv6 (by checking /etc/fail2ban/action.d/iptables-ipset-proto6.conf -> iptables-ipset.conf which handles differently each protocol)

    • ipset accepts sub-commands starting with or without -- for historical reasons.

    • 1