From f9b78ba92798da40509c5743c1d15e13d6a7f3ec Mon Sep 17 00:00:00 2001 From: Michael Gebetsroither Date: Thu, 3 Jan 2013 18:46:31 +0100 Subject: [PATCH] add support for blocking through blackhole routes --- config/action.d/route.conf | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 config/action.d/route.conf diff --git a/config/action.d/route.conf b/config/action.d/route.conf new file mode 100644 index 00000000..2d11c700 --- /dev/null +++ b/config/action.d/route.conf @@ -0,0 +1,19 @@ +# Fail2Ban configuration file +# +# Author: Michael Gebetsroither +# +# This is for blocking whole hosts through blackhole routes. +# +# PRO: +# - Works on all kernel versions and as no compatibility problems (back to debian lenny and WAY further). +# - It's FAST for very large numbers of blocked ips. +# - It's FAST because it Blocks traffic before it enters common iptables chains used for filtering. +# - It's per host, ideal as action against ssh password bruteforcing to block further attack attempts. +# - No additional software required beside iproute/iproute2 +# +# CON: +# - Blocking is per IP and NOT per service, but ideal as action against ssh password bruteforcing hosts + +[Definition] +actionban = ip route add blackhole +actionunban = ip route del blackhole