d0fcbc6c27
Rather than add a block rule for each banned IP, add a blanket block rule that references an ipfilter ippool named fail2ban. Maintain the IPs in the ippool reducing the need to search a large list of rules. An ipfilter tree pool is used.
59 lines
1.7 KiB
Plaintext
59 lines
1.7 KiB
Plaintext
--- config/action.d/ippool.conf.orig 2022-10-04 07:49:51.467484000 -0700
|
|
+++ config/action.d/ippool.conf 2022-10-04 07:49:54.523077000 -0700
|
|
@@ -0,0 +1,55 @@
|
|
+# Fail2Ban configuration file
|
|
+#
|
|
+# FreeBSD ipfilter (ippool command) ban/unban
|
|
+#
|
|
+# Author: Cy Schubert <cy@FreeBSD.org>
|
|
+#
|
|
+#
|
|
+
|
|
+[Definition]
|
|
+
|
|
+# Option: actionstart
|
|
+# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
|
+# Values: CMD
|
|
+#
|
|
+# enable IPF if not already enabled and initialize fail2ban pool
|
|
+actionstart = /sbin/ipf -E
|
|
+ /sbin/ippool -A -t tree -m fail2ban
|
|
+ echo block in log quick from pool/fail2ban to any | /sbin/ipf -f -
|
|
+
|
|
+# Option: actionstop
|
|
+# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
|
+# Values: CMD
|
|
+#
|
|
+# don't disable IPF with "/sbin/ipf -D", there may be other filters in use
|
|
+actionstop = echo block in log quick from pool/fail2ban to any | /sbin/ipf -r -f -
|
|
+ /sbin/ippool -R -t tree -m fail2ban
|
|
+
|
|
+
|
|
+# Option: actioncheck
|
|
+# Notes.: command executed once before each actionban command
|
|
+# Values: CMD
|
|
+#
|
|
+actioncheck =
|
|
+
|
|
+
|
|
+# Option: actionban
|
|
+# Notes.: command executed when banning an IP. Take care that the
|
|
+# command is executed with Fail2Ban user rights.
|
|
+# Tags: See jail.conf(5) man page
|
|
+# Values: CMD
|
|
+#
|
|
+actionban = ippool -a -t tree -m fail2ban <ip>/32
|
|
+
|
|
+
|
|
+# Option: actionunban
|
|
+# Notes.: command executed when unbanning an IP. Take care that the
|
|
+# command is executed with Fail2Ban user rights.
|
|
+# Tags: See jail.conf(5) man page
|
|
+# Values: CMD
|
|
+#
|
|
+# note -r option used to remove matching rule
|
|
+# actionunban = ippool -r -t tree -m fail2ban <ip>/32
|
|
+
|
|
+[Init]
|
|
+
|