Why fail2ban would ban an IP that is whitelisted (on ignoreip)?2019 Community Moderator ElectionHow to use fail2ban to ban all php and cgi-bin requestsFail2Ban - Failed to execute ban jail 'xxx' action 'xarf-login-attack'Why fail2ban doesn't put some IP address in jailFail2ban: cannot change default chainFail2Ban fails to ban!fail2ban keeps saying already banned but it didnt actually banHow does fail2ban protect against DDoS?fail2ban with iptables-persistentFail2ban Debian 9, freeswitchfail2ban will not ban again after first one expires
Temporarily disable WLAN internet access for children, but allow it for adults
Did arcade monitors have same pixel aspect ratio as TV sets?
Why is this estimator biased?
Open a doc from terminal, but not by its name
Do the primes contain an infinite almost arithmetic progression?
Is there an injective, monotonically increasing, strictly concave function from the reals, to the reals?
Probability that THHT occurs in a sequence of 10 coin tosses
Calculate sum of polynomial roots
What are some good ways to treat frozen vegetables such that they behave like fresh vegetables when stir frying them?
Can a Canadian Travel to the USA twice, less than 180 days each time?
Mimic lecturing on blackboard, facing audience
Is this toilet slogan correct usage of the English language?
Why is so much work done on numerical verification of the Riemann Hypothesis?
Terse Method to Swap Lowest for Highest?
Yosemite Fire Rings - What to Expect?
What happens if you are holding an Iron Flask with a demon inside and walk into an Antimagic Field?
Lowest total scrabble score
How do apertures which seem too large to physically fit work?
What should you do if you miss a job interview (deliberately)?
Does IPv6 have similar concept of network mask?
Why did the EU agree to delay the Brexit deadline?
Keeping a ball lost forever
Plot of a tornado-shaped surface
Add big quotation marks inside my colorbox
Why fail2ban would ban an IP that is whitelisted (on ignoreip)?
2019 Community Moderator ElectionHow to use fail2ban to ban all php and cgi-bin requestsFail2Ban - Failed to execute ban jail 'xxx' action 'xarf-login-attack'Why fail2ban doesn't put some IP address in jailFail2ban: cannot change default chainFail2Ban fails to ban!fail2ban keeps saying already banned but it didnt actually banHow does fail2ban protect against DDoS?fail2ban with iptables-persistentFail2ban Debian 9, freeswitchfail2ban will not ban again after first one expires
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans IP's that are under the specified CIDRs:
This is the jail:
[postfix-sasl]
enabled = true
ignoreip = 127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
filter = postfix-sasl
action_mwl = iptables-allports[name=postfix-sasl]
logpath = /var/log/zimbra.log
bantime = 3600
maxretry = 3
This is an example of a banned IP under one of the CIDRs specified on the ignoreip option (192.168.0.0/16):
Chain f2b-postfix-sasl (1 references)
target prot opt source destination
REJECT all -- 192.168.11.54 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
This are the lines matching this IP on the /var/log/fail2ban/log:
2019-03-21 09:21:33,269 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:48,290 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:49,044 fail2ban.actions [32293]: NOTICE [postfix-sasl] Ban 192.168.11.54
I can see on the fail2ban wiki that the ignoreip can accept space separated values and CIDR notations, from the fail2ban wiki:
# Option: ignoreip.
# Notes.: space separated list of IP's to be ignored by fail2ban..
# You can use CIDR mask in order to specify a range..
# Example: ignoreip = 192.168.0.1/24 123.45.235.65.
# Values: IP Default: 192.168.0.0/24.
#.
ignoreip = 192.168.1.0/24
iptables fail2ban
asked yesterday
altmas5altmas5
311211
add a comment |
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans IP's that are under the specified CIDRs:
This is the jail:
[postfix-sasl]
enabled = true
ignoreip = 127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
filter = postfix-sasl
action_mwl = iptables-allports[name=postfix-sasl]
logpath = /var/log/zimbra.log
bantime = 3600
maxretry = 3
This is an example of a banned IP under one of the CIDRs specified on the ignoreip option (192.168.0.0/16):
Chain f2b-postfix-sasl (1 references)
target prot opt source destination
REJECT all -- 192.168.11.54 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
This are the lines matching this IP on the /var/log/fail2ban/log:
2019-03-21 09:21:33,269 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:48,290 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:49,044 fail2ban.actions [32293]: NOTICE [postfix-sasl] Ban 192.168.11.54
I can see on the fail2ban wiki that the ignoreip can accept space separated values and CIDR notations, from the fail2ban wiki:
# Option: ignoreip.
# Notes.: space separated list of IP's to be ignored by fail2ban..
# You can use CIDR mask in order to specify a range..
# Example: ignoreip = 192.168.0.1/24 123.45.235.65.
# Values: IP Default: 192.168.0.0/24.
#.
ignoreip = 192.168.1.0/24
iptables fail2ban
asked yesterday
altmas5altmas5
311211
add a comment |
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans IP's that are under the specified CIDRs:
This is the jail:
[postfix-sasl]
enabled = true
ignoreip = 127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
filter = postfix-sasl
action_mwl = iptables-allports[name=postfix-sasl]
logpath = /var/log/zimbra.log
bantime = 3600
maxretry = 3
This is an example of a banned IP under one of the CIDRs specified on the ignoreip option (192.168.0.0/16):
Chain f2b-postfix-sasl (1 references)
target prot opt source destination
REJECT all -- 192.168.11.54 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
This are the lines matching this IP on the /var/log/fail2ban/log:
2019-03-21 09:21:33,269 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:48,290 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:49,044 fail2ban.actions [32293]: NOTICE [postfix-sasl] Ban 192.168.11.54
I can see on the fail2ban wiki that the ignoreip can accept space separated values and CIDR notations, from the fail2ban wiki:
# Option: ignoreip.
# Notes.: space separated list of IP's to be ignored by fail2ban..
# You can use CIDR mask in order to specify a range..
# Example: ignoreip = 192.168.0.1/24 123.45.235.65.
# Values: IP Default: 192.168.0.0/24.
#.
ignoreip = 192.168.1.0/24
iptables fail2ban
asked yesterday
altmas5altmas5
311211
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans IP's that are under the specified CIDRs:
This is the jail:
[postfix-sasl]
enabled = true
ignoreip = 127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
filter = postfix-sasl
action_mwl = iptables-allports[name=postfix-sasl]
logpath = /var/log/zimbra.log
bantime = 3600
maxretry = 3
This is an example of a banned IP under one of the CIDRs specified on the ignoreip option (192.168.0.0/16):
Chain f2b-postfix-sasl (1 references)
target prot opt source destination
REJECT all -- 192.168.11.54 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
This are the lines matching this IP on the /var/log/fail2ban/log:
2019-03-21 09:21:33,269 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:48,290 fail2ban.filter [32293]: INFO [postfix-sasl] Found 192.168.11.54
2019-03-21 09:21:49,044 fail2ban.actions [32293]: NOTICE [postfix-sasl] Ban 192.168.11.54
I can see on the fail2ban wiki that the ignoreip can accept space separated values and CIDR notations, from the fail2ban wiki:
# Option: ignoreip.
# Notes.: space separated list of IP's to be ignored by fail2ban..
# You can use CIDR mask in order to specify a range..
# Example: ignoreip = 192.168.0.1/24 123.45.235.65.
# Values: IP Default: 192.168.0.0/24.
#.
ignoreip = 192.168.1.0/24
iptables fail2ban
iptables fail2ban
asked yesterday
altmas5altmas5
311211
asked yesterday
altmas5altmas5
311211
edited 8 hours ago
altmas5
asked yesterday
altmas5altmas5
311211
asked yesterday
altmas5altmas5
311211
asked yesterday
altmas5altmas5
311211
311211
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f507756%2fwhy-fail2ban-would-ban-an-ip-that-is-whitelisted-on-ignoreip%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f507756%2fwhy-fail2ban-would-ban-an-ip-that-is-whitelisted-on-ignoreip%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
