f2b adding to iptables but not banning about docker-fail2ban HOT 2 CLOSED

Hi there :)
I would recommend setting "banaction" directly instead of "action".
Also I'm not sure if you should use the same filter action name for two different jails.
Keeping them seperate is usually better imo.

Also remember: if you are using some kind of proxy (like cloudflare) and traffic is coming in on SSL, the real IP can't be seen (in the encrypted "x-forwarded-for"-header), meaning the request won't be blocked and still show up in the logs.

Hope this helps a little, cheers :)

from docker-fail2ban.

Hi there :)
I would recommend setting "banaction" directly instead of "action".
Also I'm not sure if you should use the same filter action name for two different jails.
Keeping them seperate is usually better imo.

Also remember: if you are using some kind of proxy (like cloudflare) and traffic is coming in on SSL, the real IP can't be seen (in the encrypted "x-forwarded-for"-header), meaning the request won't be blocked and still show up in the logs.

Hope this helps a little, cheers :)

Heya,

Thank you for replying! You've certainly triggered a thought process re Cloudflare.

So I was passing the real IP of the client, but that obviously wasn't the IP address that was hitting the server (due to CF).

My solution was to use Fail2Ban with the Cloudflare action and get f2b to block at Cloudflare instead of at the server, also more secure that way in many respects.

Solution:

[bitwarden]
enabled = true
port = 80,443,8089,3012
filter = bitwarden
logpath = /bitwarden.log
action = iptables-multiport
         cloudflare
findtime = 3600
bantime = 3600
maxretry = 3

[bitwarden-admin]
enabled = true
port = 80,443,8081
filter = bitwarden-admin
action = iptables-multiport
         cloudflare
logpath = /bitwarden.log
maxretry = 3
bantime = 3600
findtime = 3600

Setting up the cloudflare action: https://community.cloudflare.com/t/can-i-still-use-fail2ban-while-using-cloudflare-article/63674

Thanks again!

from docker-fail2ban.