Fail2ban

Fail2Ban Installation from GitHub (EN)

In case an existing Fail2Ban server is running:

sudo service fail2ban stop

Download version 0.10 from GitHub:

wget https://github.com/fail2ban/fail2ban/archive/0.10.0.tar.gz -O fail2ban-0.10.0.tar.gz

Unpack and install:
<source>sudo tar -zxpvf fail2ban-0.10.0.tar.gz

cd fail2ban-0.10.0

sudo python setup.py install

This will install Fail2Ban into the python library directory. The executable scripts are placed into /usr/local/bin and configuration under /etc/fail2ban.

Enable fail2ban as an automatic service:

sudo cp files/debian-initd /etc/init.d/fail2ban

sudo update-rc.d fail2ban defaults

sudo service fail2ban start

Using IP sets instead of iptables chains

By default Fail2Ban uses iptables chains to block IP addresses.

Example:

root@fwserv1:~# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -m set --match-set fail2ban-ssh src -j DROP
-A FORWARD -m set --match-set fail2ban-ssh src -j DROP
-A f2b-sshd -s 120.52.56.124/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 116.193.161.242/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.215.237.205/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 118.244.238.18/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 155.133.82.12/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 49.4.6.132/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 118.244.206.22/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 61.132.29.162/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 192.160.102.169/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 162.247.72.213/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 149.56.223.241/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 27.255.79.82/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 211.104.171.220/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 187.252.208.82/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 116.6.49.126/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
root@fwserv1:~#_

Since Linux Kernel 2.6 there is an option to use so-called IP sets to hold big amount of IP addresses in the memory. This technique uses hashtables to store and search IP adresses and is therefore much more efficient than parsing sequentially through the iptables rules.

The following shell script fwfail2ban moves IP addresses from the iptables rules to an IP set:

#!/bin/bash
#
# Author:  Frank Wulf
# Version: 1.0 (2017-10-02)
#
# This program moves iptables entries created by fail2ban to
# an IP set in the Linux Kernel. Advantage is that ipset uses
# a hashtable to store/fetch IP addresses and thus the IP lookup
# is much more efficient and faster than sequentially parsing
# the iptables rules.
#
# Version history:
# 1.0   2017-10-02   Initial release
#

# Temporary output file
out=/tmp/fwfail2ban.out

# Build the ipset if not exist
ipset -exist create fail2ban-ssh hash:ip

# Build the iptables rules to use ipset if not exist
iptables -C INPUT -m set --match-set fail2ban-ssh src -j DROP 1>/dev/null 2>&1
if [ $? -ne 0 ]; then
  iptables -I INPUT -m set --match-set fail2ban-ssh src -j DROP
fi
iptables -C FORWARD -m set --match-set fail2ban-ssh src -j DROP 1>/dev/null 2>&1
if [ $? -ne 0 ]; then
  iptables -I FORWARD -m set --match-set fail2ban-ssh src -j DROP
fi

# Get banned IP addresses from iptables
iptables -L f2b-sshd -v -n | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'| awk '{print $8}' | grep -v '0\.0\.0\.0' >$out

while read ipaddr; do
  # Add IP address to ipset
  ipset add fail2ban-ssh $ipaddr 1>/dev/null 2>&1
  # Remove IP address from iptables and fail2ban database
  fail2ban-client unban $ipaddr 1>/dev/null 2>&1
done <$out

# Save IP set to enable restoring after reboot
ipset save -f /etc/iptables/rules.ipset

# Save iptables to enable restoring after reboot, the entries created
# by fail2ban are filtered because those will be restored by fail2ban
# itself.
iptables-save | grep -v "^\-A.*f2b-sshd" > /etc/iptables/rules.v4

# Remove output file
rm $out

The script runs once a day via cron. So during the day fail2ban bans IP addresses with iptables rules which are then moved at 0:00 o'clock to an IP set.

There are some points to consider: By default both iptables rules and IP sets are hold in the memory and get lost during a reboot. Therefore the script has a mechanism to save the data which then can be automatically restored after a reboot.