Fail2Ban - IP表拒绝禁止

Question

我在Ubuntu16上运行了fail2ban，运行了几个监狱。

一个是http-get-dos：

jail.conf

[http-get-dos]
enabled = true
port = http,https
filter = http-get-dos
logpath = /var/log/apache2/access.log
maxretry = 100
findtime = 60
#ban for 5 minutes
bantime = 600
action = iptables[name=HTTP, port=http, protocol=tcp]

过滤器文件：

# Fail2Ban configuration file
[Definition]

# Option: failregex
# Note: This regex will match any GET entry in your logs, so basically all valid and not valid entries are a match.
# You should set up in the jail.conf file, the maxretry and findtime carefully in order to avoid false positives.
failregex = ^<HOST> -.*"(GET|POST).*
# Option: ignoreregex
ignoreregex =

Fail2Ban内部的监狱似乎运转良好--我只是通过敲击URL来测试它，我的IP被添加到IP表中。

然而，我实际上并没有被阻止-- IP表拒绝似乎不起作用。

my.ip.address出现在链式Fail2Ban-HTTPa拒绝中的IP表中，但我没有被拒绝(仍然可以访问站点)。

iptables -nvL --行号

Chain INPUT (policy ACCEPT 2689 packets, 413K bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1       68  5849 fail2ban-HTTP  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
2     3104  575K fail2ban-apache-overflows  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
3     3104  575K fail2ban-apache  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
4      728 43824 fail2ban-ssh  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 3325 packets, 4380K bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain fail2ban-HTTP (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 REJECT     all  --  *      *       my.ip.address
     0.0.0.0/0            reject-with icmp-port-unreachable
2       68  5849 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-apache (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1     3104  575K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-apache-overflows (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1     3104  575K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-ssh (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1      728 43824 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0  

我想知道这是否是一个订单问题--也就是说，全局接受超过了fail2ban规则在IPTables中的地位。但如果这是问题所在，我不知道如何解决，也不知道为什么fail2ban一开始就把它放得不够高。

任何建议都可以，非常感谢。

Answer 1

您正在监视http和https，但只禁止使用iptables操作的http。使用iptables-multiport动作并同时禁止http和https。

action = iptables-multiport[name=HTTP, port="http,https", protocol=tcp]