prehistoric-systems/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-03-11 08:55:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge 0b10bf9325 into ef65652671

Browse source
This commit is contained in:
Georgiy Sitnikov 2025-12-01 00:14:21 -05:00 committed by GitHub
commit d7cedda669
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 62 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -117,7 +117,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
* `filter.d/sendmail-reject.conf` - also recognize "Domain of sender address ... does not resolve" (gh-4035)
* `filter.d/vaultwarden.conf` - new filter and jail for Vaultwarden (gh-3979)
* `fail2ban-regex` extended with new option `-i` or `--invert` to output not-matched lines by `-o` or `--out` (gh-4001)
* `filter.d/filter-ip-blacklist.conf` add IPv4 Subnet blocking filter
ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km
-----------

43
config/filter.d/filter-ip-blacklist.conf Normal file
View file

@ -0,0 +1,43 @@
[Definition]
# Option: failregex
# Notes : Detection of blocked ip addresses.
# Values: TEXT
#
failregex = ^(?P<ip4>\d{1,3}(?:\.\d{1,3}){3}/\d{1,2})\s+
# Option: ignoreregex
# Notes : Regex to ignore.
# Values: TEXT
#
ignoreregex =
datepattern = ^\[?ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second
########################################
#
# Single IP Example:
# 10.10.10.10/32 [2015-01-01 12:00:00]
#
#########################################
#
# IP Range Options:
# 10.10.10.10/32 = 10.10.10.10
# 10.10.10.10/24 = 10.10.10.*
# 10.10.10.10/16 = 10.10.*.*
# 10.10.10.10/8 = 10.*.*.*
#
#########################################
#
# IP Range Examples:
# 10.10.10.10/16 [2015-01-01 12:00:00]
# 10.10.10.10/24 [2015-01-01 12:00:00]
#
#########################################
#
# You can use following command to add ips:
# echo "10.10.10.10/8 [$(date +"%Y-%m-%d %H:%M:%S")]" >> /var/log/ip-blacklist.log
#
#########################################

8
config/jail.conf
View file

@ -995,3 +995,11 @@ logpath = /var/log/daemon.log
[vaultwarden]
port = http,https
logpath = /var/log/vaultwarden.log
[ip-blacklist]
action = iptables-allports
filter = filter-ip-blacklist
logpath = /var/log/ip-blacklist.log
maxretry = 0
findtime = 15552000
bantime = -1

10
fail2ban/tests/files/logs/ip-blacklist.log Normal file
View file

@ -0,0 +1,10 @@
# failJSON: { "time": "2015-01-01 12:00:00", "match": false }
10.10.10.10 [2015-01-01 12:00:00]
# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/32" }
10.10.10.10/32 [2015-01-01 12:00:00]
# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/24" }
10.10.10.10/24 [2015-01-01 12:00:00]
# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/16" }
10.10.10.10/16 [2015-01-01 12:00:00]
# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/8" }
10.10.10.10/8 [2015-01-01 12:00:00]