Fail2ban - IP blacklist - Raspberry Pi Forums

hello,

i'm trying create blacklist persistent attackers using fail2ban.

i've been searching web , found couple variations of i'm trying accomplish i'm confused variation better.

first step straight forward: create blacklist file

code: select all

sudo touch /etc/fail2ban/ip.blacklist 

second step start little confused because on 1 site said configure iptables-allports.conf while on site said configure iptables-multiport.conf. difference? 1 should configured?

blacklist ip address following line should added under actionstart:

code: select all

cat /etc/fail2ban/ip.blacklist-<name> | while read ip; iptables -i fail2ban-<name> 1 -s $ip -j drop; done 

and following line under actionban:

code: select all

echo '<ip>/24' >> /etc/fail2ban/ip.blacklist-<name> 

on site said following:

code: select all

actionstart cat /etc/fail2ban/ip.blacklist | while read ip; iptables -i fail2ban-<name> 1 -s $ip -j drop; done  actionban echo '<ip>' >> /etc/fail2ban/ip.blacklist 

only slight differece don't understand difference means. -<name> added end of ip.blacklist do? adding /24 end of <ip> do?

next, how stop duplicate ip addresses being added? 1 possible solution found adding sort & uniq line added in actionstart:

code: select all

actionstart: cat /etc/fail2ban/ip.blacklist | sort | uniq | while read ip; iptables -i fail2ban-<name> 1 -s $ip -j drop; done 

is correct?

finally, if want remove ip address blacklist file, 1 possible solution found add following line under actionunban:

code: select all

sed -i '/<ip>/d' /ect/fail2ban/ip.blacklist 

is correct?

these questions appreciated. thank you.

how this: http://zach.seifts.us/posts/2013/07/14/ ... persistent

every ip ever gets banned gets added ip.blacklist banned rest of time in universe.

raspberrypi