Hello, I'm trying to create a blacklist of banned IP Addresses for persistent attackers using fail2ban. I've been searching the web and found a couple variations of what I'm trying to accomplish but I'm confused as to which variation would be better. First step is straight forward: create blacklist file [code] sudo touch /etc/fail2ban/ip.blacklist [/code]Second step is where I start get a little confused because on one site it said to configure [b][i]iptables-allports.conf[/i][/b] while on another site it said to configure [b][i]iptables-multiport.conf[/i][/b]. What is the difference? Which one should be configured? [code] sudo nano /etc/fail2ban/action.d/iptables-allports.conf or sudo nano /etc/fail2ban/action.d/iptables-multiport.conf [/code]To blacklist the IP address the following lines are added: [code] actionstart: cat /etc/fail2ban/ip.blacklist- | while read IP; do iptables -I fail2ban- 1 -s $IP -j DROP; done actionban: echo '/24' >> /etc/fail2ban/ip.blacklist- [/code]On another site it said the following: [code] actionstart: cat /etc/fail2ban/ip.blacklist | while read IP; do iptables -I fail2ban- 1 -s $IP -j DROP; done actionban: echo '' >> /etc/fail2ban/ip.blacklist [/code]Only a slight differece but I don't understand what that difference means. What does the - added to the end of ip.blacklist do? What does adding /24 to the end of do? Next, how do I stop duplicate IP addresses from being added? One possible solution that I found is by adding sort & uniq to the line added in actionstart: [code] actionstart: cat /etc/fail2ban/ip.blacklist | sort | uniq | while read IP; do iptables -I fail2ban- 1 -s $IP -j DROP; done [/code]Is this correct? Finally, if I want to remove an IP address from the blacklist file, one possible solution that I found is to add the following line under [b]actionunban[/b]: [code] sed -i '//d' /ect/fail2ban/ip.blacklist [/code]Is this correct? Can someone please help me to understand all of this?

fail2ban - making banned IPs persistent

isofox

Hello,

I'm trying to create a blacklist of banned IP Addresses for persistent attackers using fail2ban.

I've been searching the web and found a couple variations of what I'm trying to accomplish but I'm confused as to which variation would be better.

First step is straight forward: create blacklist file

sudo touch /etc/fail2ban/ip.blacklist

Second step is where I start get a little confused because on one site it said to configure iptables-allports.conf while on another site it said to configure iptables-multiport.conf. What is the difference? Which one should be configured?

sudo nano /etc/fail2ban/action.d/iptables-allports.conf
or
sudo nano /etc/fail2ban/action.d/iptables-multiport.conf

To blacklist the IP address the following lines are added:

actionstart:
cat /etc/fail2ban/ip.blacklist-<name> | while read IP; do iptables -I fail2ban-<name> 1 -s $IP -j DROP; done

actionban:
echo '<ip>/24' >> /etc/fail2ban/ip.blacklist-<name>

On another site it said the following:

actionstart:
cat /etc/fail2ban/ip.blacklist | while read IP; do iptables -I fail2ban-<name> 1 -s $IP -j DROP; done

actionban:
echo '<ip>' >> /etc/fail2ban/ip.blacklist

Only a slight differece but I don't understand what that difference means. What does the -<name> added to the end of ip.blacklist do? What does adding /24 to the end of <ip> do?

Next, how do I stop duplicate IP addresses from being added? One possible solution that I found is by adding sort & uniq to the line added in actionstart:

actionstart:
cat /etc/fail2ban/ip.blacklist | sort | uniq | while read IP; do iptables -I fail2ban-<name> 1 -s $IP -j DROP; done

Is this correct?

Finally, if I want to remove an IP address from the blacklist file, one possible solution that I found is to add the following line under actionunban:

sed -i '/<ip>/d' /ect/fail2ban/ip.blacklist

Is this correct?

Can someone please help me to understand all of this?