[DEFAULT]
# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time
bantime.increment = true
# "bantime.maxtime" is the max number of seconds using the ban time can reach (doesn't grow further)
bantime.maxtime = 5w
# "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier
bantime.factor = 24
# "bantime" is the number of seconds that a host is banned.
bantime = 1h
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 24h
# "maxretry" is the number of failures before a host get banned.
maxretry = 5
# Prevents banning LAN subnets
ignoreip = 127.0.0.1/8 ::1
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
# The ban action "iptables-multiport" (default) should work for most
# The ban action "iptables-allports" can be used if multiport causes issues
banaction = iptables-multiport
banaction_allports = iptables-allports
# Read https://github.com/sebres/PoC/blob/master/FW.IDS-DROP-vs-REJECT/README.md before changing block type
# The block type "REJECT --reject-with icmp-port-unreachable" (default behavior) should respond to, but then instantly reject connection attempts
# The block type "DROP" should not respond to connection attempts, resulting in a timeout
#banaction = iptables-multiport[blocktype=DROP]
# Add additional actions
action = %(action_)s
# [sshd]
# configuration inherits from jail.conf
# enabled = true
# chain = INPUT
# action = %(action_)s
[nginx-http-auth]
# configuration inherits from jail.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-badbots]
# configuration inherits from jail.d/nginx-badbots.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-botsearch]
# configuration inherits from jail.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-deny]
# configuration inherits from jail.d/nginx-deny.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-unauthorized]
# configuration inherits from jail.d/nginx-unauthorized.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-404]
# Custom filter to detect excessive 404 errors
enabled = true
chain = INPUT
port = http,https
filter = nginx-404
logpath = /remotelogs/nginx/access.log
maxretry = 3
findtime = 10s
bantime = 1h
action = %(action_)s
slack
# Fail2Ban configuration file
#
# Action to send notifications to Slack
#
[Definition]
# Option: actionstart
# Notes.: command executed once at the start of Fail2Ban.
actionstart = curl -X POST -H 'Content-type: application/json' \
--data '{"text":"[Fail2Ban] <name> jail has started"}' \
<slack_webhook_url>
# Option: actionstop
# Notes.: command executed once at the end of Fail2Ban
actionstop = curl -X POST -H 'Content-type: application/json' \
--data '{"text":"[Fail2Ban] <name> jail has stopped"}' \
<slack_webhook_url>
# Option: actioncheck
# Notes.: command executed once before each actionban command
actioncheck =
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
actionban = curl -X POST -H 'Content-type: application/json' \
--data '{"text":"[Fail2Ban] :no_entry: <name> jail banned IP: *<ip>*\nFailures: <failures>\nTime: <time>"}' \
<slack_webhook_url>
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
actionunban = curl -X POST -H 'Content-type: application/json' \
--data '{"text":"[Fail2Ban] :white_check_mark: <name> jail unbanned IP: *<ip>*"}' \
<slack_webhook_url>
[Init]
# Slack webhook URL
slack_webhook_url = https://hooks.slack.com/services/xxx/xxx/xxx
動作確認
docker compose up -d
あとは localhost/test などで 404 を発生させると通知が来ます
unbanip で ban 解除しても通知が来ます
[DEFAULT]
# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time
bantime.increment = true
# "bantime.maxtime" is the max number of seconds using the ban time can reach (doesn't grow further)
bantime.maxtime = 5w
# "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier
bantime.factor = 24
# "bantime" is the number of seconds that a host is banned.
bantime = 1h
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 24h
# "maxretry" is the number of failures before a host get banned.
maxretry = 5
# Prevents banning LAN subnets
ignoreip = 127.0.0.1/8 ::1
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
# The ban action "iptables-multiport" (default) should work for most
# The ban action "iptables-allports" can be used if multiport causes issues
banaction = iptables-multiport
banaction_allports = iptables-allports
# Read https://github.com/sebres/PoC/blob/master/FW.IDS-DROP-vs-REJECT/README.md before changing block type
# The block type "REJECT --reject-with icmp-port-unreachable" (default behavior) should respond to, but then instantly reject connection attempts
# The block type "DROP" should not respond to connection attempts, resulting in a timeout
#banaction = iptables-multiport[blocktype=DROP]
# Add additional actions
action = %(action_)s
apprise-api[host="127.0.0.1", tag="fail2ban"]
cloudflare[cfuser="YOUR-EMAIL", cftoken="YOUR-TOKEN"]
# [sshd]
# configuration inherits from jail.conf
# enabled = true
# chain = INPUT
# action = %(action_)s
[nginx-http-auth]
# configuration inherits from jail.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-badbots]
# configuration inherits from jail.d/nginx-badbots.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-botsearch]
# configuration inherits from jail.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-deny]
# configuration inherits from jail.d/nginx-deny.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-unauthorized]
# configuration inherits from jail.d/nginx-unauthorized.conf
enabled = true
chain = DOCKER-USER
action = %(action_)s
[nginx-404]
# Custom filter to detect excessive 404 errors
enabled = true
chain = INPUT
port = http,https
filter = nginx-404
logpath = /remotelogs/nginx/access.log
maxretry = 3
findtime = 10s
bantime = 1h
banaction などは適切なものを設定しましょう
ポイントは一番下の nginx-404 です
これで 404 を連発する IP を ban にできます
それ以外も nginx の ban ルールですが認証エラーなどで発生させるのが難しいので今回 404 を追加しています
config/filter.d/nginx-404.conf
# Fail2Ban filter to detect excessive 404 errors from nginx
# Detects clients making too many requests to non-existent pages
[Definition]
failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*" 404
ignoreregex =
datepattern = {^LN-BEG}%%d/%%b/%%ExY:%%H:%%M:%%S
docker compose exec fail2ban fail2ban-client status nginx-404
Status for the jail: nginx-404
|- Filter
| |- Currently failed: 0
| |- Total failed: 6
| `- File list: /remotelogs/nginx/access.log
`- Actions
|- Currently banned: 1
|- Total banned: 1
`- Banned IP list: xxx.xxx.xxx.xxx
ban されると i-Filter のお馴染みの画面が表示されるようになります
また iptables -L でホスト側を確認するとちゃんと REJECT ルールがあることが確認できると思います
