From 5cf23c7b7dd73e037bb1335ae9af6f579c49eda4 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 23 Oct 2025 10:18:50 +0200 Subject: [PATCH 1/6] Add Filter IP Black list --- config/filter.d/filter-ip-blacklist.conf | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 config/filter.d/filter-ip-blacklist.conf diff --git a/config/filter.d/filter-ip-blacklist.conf b/config/filter.d/filter-ip-blacklist.conf new file mode 100644 index 00000000..506ed2d5 --- /dev/null +++ b/config/filter.d/filter-ip-blacklist.conf @@ -0,0 +1,15 @@ +[Definition] + +# Option: failregex +# Notes : Detection of blocked ip addresses. +# Values: TEXT +# + +failregex = ^(?P\d{1,3}(?:\.\d{1,3}){3}/\d{1,2})\s+ + +# Option: ignoreregex +# Notes : Regex to ignore. +# Values: TEXT +# + +ignoreregex = From add82cc0511e3420d7c86ef4f21c62ae8da4e034 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 23 Oct 2025 10:27:21 +0200 Subject: [PATCH 2/6] Add IP blacklist configuration to jail.conf --- config/jail.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/jail.conf b/config/jail.conf index 66d6b107..9b4e03ff 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -995,3 +995,11 @@ logpath = /var/log/daemon.log [vaultwarden] port = http,https logpath = /var/log/vaultwarden.log + +[ip-blacklist] +action = iptables-allports +filter = filter-ip-blacklist +logpath = /var/log/ip-blacklist.log +maxretry = 0 +findtime = 15552000 +bantime = -1 From 610f41c6983036ca82feb1d17c3b8a9f260cf335 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 23 Oct 2025 10:34:40 +0200 Subject: [PATCH 3/6] Update filter-ip-blacklist.conf with examples Added examples and instructions for IP blacklisting. --- config/filter.d/filter-ip-blacklist.conf | 30 ++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/config/filter.d/filter-ip-blacklist.conf b/config/filter.d/filter-ip-blacklist.conf index 506ed2d5..3c0e71db 100644 --- a/config/filter.d/filter-ip-blacklist.conf +++ b/config/filter.d/filter-ip-blacklist.conf @@ -13,3 +13,33 @@ failregex = ^(?P\d{1,3}(?:\.\d{1,3}){3}/\d{1,2})\s+ # ignoreregex = + +datepattern = ^\[?ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second + +######################################## +# +# Single IP Example: +# 10.10.10.10 +# 10.10.10.10 [2015-01-01 12:00:00] +# 10.10.10.10/32 [2015-01-01 12:00:00] +# +######################################### +# +# IP Range Options: +# 10.10.10.10/32 = 10.10.10.10 +# 10.10.10.10/24 = 10.10.10.* +# 10.10.10.10/16 = 10.10.*.* +# 10.10.10.10/8 = 10.*.*.* +# +######################################### +# +# IP Range Examples: +# 10.10.10.10/16 [2015-01-01 12:00:00] +# 10.10.10.10/24 [2015-01-01 12:00:00] +# +######################################### +# +# You can use following command to add ips: +# echo "10.10.10.10/8 [$(date +"%Y-%m-%d %H:%M:%S")]" >> /var/log/ip-blacklist.log +# +######################################### From 422e09758c800fce0d2fcfb7923fb3feb1b048cb Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 23 Oct 2025 10:53:32 +0200 Subject: [PATCH 4/6] Add ip-blacklist.log with test IP entries --- fail2ban/tests/files/logs/ip-blacklist.log | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 fail2ban/tests/files/logs/ip-blacklist.log diff --git a/fail2ban/tests/files/logs/ip-blacklist.log b/fail2ban/tests/files/logs/ip-blacklist.log new file mode 100644 index 00000000..b1f30287 --- /dev/null +++ b/fail2ban/tests/files/logs/ip-blacklist.log @@ -0,0 +1,10 @@ +# failJSON: { "time": "2015-01-01 12:00:00", "match": false } +10.10.10.10 [2015-01-01 12:00:00] +# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/32" } +10.10.10.10/32 [2015-01-01 12:00:00] +# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/24" } +10.10.10.10/24 [2015-01-01 12:00:00] +# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/16" } +10.10.10.10/16 [2015-01-01 12:00:00] +# failJSON: { "time": "2015-01-01 12:00:00", "match": true , "host": "10.10.10.10/8" } +10.10.10.10/8 [2015-01-01 12:00:00] From e202ce419fdc40519da40071fa62c47a92840896 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 23 Oct 2025 10:57:16 +0200 Subject: [PATCH 5/6] Add IPv4 Subnet blocking filter to ChangeLog Added a new IPv4 Subnet blocking filter to the configuration. --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index d6588117..56150cb1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -114,7 +114,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `filter.d/sendmail-reject.conf` - also recognize "Domain of sender address ... does not resolve" (gh-4035) * `filter.d/vaultwarden.conf` - new filter and jail for Vaultwarden (gh-3979) * `fail2ban-regex` extended with new option `-i` or `--invert` to output not-matched lines by `-o` or `--out` (gh-4001) - +* `filter.d/filter-ip-blacklist.conf` add IPv4 Subnet blocking filter ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km ----------- From 0b10bf93250c09f85eeeaa3e77c7a9cf353481ff Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 23 Oct 2025 10:58:20 +0200 Subject: [PATCH 6/6] Clean up IP blacklist configuration comments Removed commented-out examples of single IP entries. --- config/filter.d/filter-ip-blacklist.conf | 2 -- 1 file changed, 2 deletions(-) diff --git a/config/filter.d/filter-ip-blacklist.conf b/config/filter.d/filter-ip-blacklist.conf index 3c0e71db..1d08113d 100644 --- a/config/filter.d/filter-ip-blacklist.conf +++ b/config/filter.d/filter-ip-blacklist.conf @@ -19,8 +19,6 @@ datepattern = ^\[?ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:S ######################################## # # Single IP Example: -# 10.10.10.10 -# 10.10.10.10 [2015-01-01 12:00:00] # 10.10.10.10/32 [2015-01-01 12:00:00] # #########################################