Home / server / Questions / 639737
In Process
nulltek
Asked: 2014-10-27 06:20:38 +0800 CST

fail2ban flushing my existing IPTABLES rules

  • 772

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a bruteforce attack, it does add the offending IP address properly, however it flushes out my BLACkLIST chain, which I need to keep intact.

Any thoughts on why this is happening and how I can persist the BLACKLIST chain?

iptables

1 Answers

  1. I assume you use shorewall as your firewall? If yes, you might want to change the action of fail2ban to shorewall instead of iptables in jail.conf:

    ...
[ssh-iptables]
enabled = false
...

[ssh-shorewall]
enabled  = true
filter   = sshd
action   = shorewall
logpath  = /var/log/auth.log                                                                    
maxretry = 5
....
    • 1