summaryrefslogtreecommitdiffstats
path: root/roles/common/templates
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2022-12-14 12:01:33 +0100
committerGuilhem Moulin <guilhem@fripost.org>2022-12-18 13:29:34 +0100
commit7ea3baad594b889f6f7f4e7e4ccc4dc7c0099bc6 (patch)
tree211a5c2004e22bc858c00560bbd37e1137b07816 /roles/common/templates
parentc854664b9043e9a04fe0115fb115643543eddf6f (diff)
Improve Debian 11's fail2ban rules.
Diffstat (limited to 'roles/common/templates')
-rw-r--r--roles/common/templates/etc/fail2ban/jail.local.j24
-rwxr-xr-xroles/common/templates/etc/nftables.conf.j26
2 files changed, 6 insertions, 4 deletions
diff --git a/roles/common/templates/etc/fail2ban/jail.local.j2 b/roles/common/templates/etc/fail2ban/jail.local.j2
index b01709a..3cd19cc 100644
--- a/roles/common/templates/etc/fail2ban/jail.local.j2
+++ b/roles/common/templates/etc/fail2ban/jail.local.j2
@@ -13,7 +13,9 @@ destemail = admin@fripost.org
ignoreip = 127.0.0.0/8, ::1, {{ ipsec_subnet }}
banaction = nftables-allports
-logpath = /var/log/fail2ban/fail2ban.log
+
+# must match nftables.conf's blackholes timeouts
+bantime = 10m
#
# JAILS
diff --git a/roles/common/templates/etc/nftables.conf.j2 b/roles/common/templates/etc/nftables.conf.j2
index 66b1f9d..805d1a8 100755
--- a/roles/common/templates/etc/nftables.conf.j2
+++ b/roles/common/templates/etc/nftables.conf.j2
@@ -145,7 +145,7 @@ table inet raw {
}
table inet filter {
- # blackholes
+ # blackholes (timeout must match /etc/fail2ban/jail.local)
set fail2ban { type ipv4_addr; timeout 10m; }
set fail2ban6 { type ipv6_addr; timeout 10m; }
@@ -186,8 +186,8 @@ table inet filter {
ip6 version 6 udp sport 547 udp dport 546 ct state related,established accept
{% endif %}
- meta l4proto tcp ip saddr @fail2ban counter drop
- meta l4proto tcp ip6 saddr @fail2ban6 counter drop
+ ip saddr @fail2ban counter drop
+ ip6 saddr @fail2ban6 counter drop
tcp dport $in-tcp-ports ct state related,established accept
tcp dport $in-tcp-ports ct state new counter accept