Fail2Ban blocks ip despite both ignoreself and ignoreip being set in jail.local

Andrew

12/21/22, 10:39 AM

solution: The IP range in ignoreip was set incorrectly using CIDR. It should have been 192.168.2.0/24 rather than 192.168.2.1/32.

original post:

Another user had a similar problem caused by conflicting ignoreip's (jail.local's ignoreip replacing jail.conf's). However, the only ignoreip I am using is the one in jail.local, and I have not edited jail.conf at all, so the user's solution did not apply for me.

I've made the following changes in jail.local:

>diff /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

87c87
< #ignoreself = true
---
> ignoreself = true
92c92
< #ignoreip = 192.168.2.0/255
---
> ignoreip = 192.168.2.1/32 ::1
101c101
< bantime = 10m
---
> bantime = -1
208c208
< banaction = iptables-multiport
---
> banaction = iptables-allports

All of these changes are within the [DEFAULT] block.

I've >sudo /etc/init.d/fail2ban restart'ed many times, and >sudo shutdown -r 0'd many times as well. Despite this, every time I try to intentionally fail ssh logins from 192.168.2.13, the IP gets blocked after 5 tries. After this, I have to manually unban it using >sudo fail2ban-client set sshd unbanip 192.168.2.13.

>tail /var/log/fail2ban.log

2021-08-20 21:43:57,190 fail2ban.jail [1703]: INFO Jail 'sshd' started
2021-08-20 21:44:04,082 fail2ban.filter [1703]: INFO [sshd] Found 192.168.2.13 - 2021-08-20 21:44:03
2021-08-20 21:44:05,792 fail2ban.filter [1703]: INFO [sshd] Found 192.168.2.13 - 2021-08-20 21:44:05
2021-08-20 21:44:10,357 fail2ban.filter [1703]: INFO [sshd] Found 192.168.2.13 - 2021-08-20 21:44:09
2021-08-20 21:44:15,613 fail2ban.filter [1703]: INFO [sshd] Found 192.168.2.13 - 2021-08-20 21:44:15
2021-08-20 21:44:19,166 fail2ban.filter [1703]: INFO [sshd] Found 192.168.2.13 - 2021-08-20 21:44:19
2021-08-20 21:44:19,216 fail2ban.actions [1703]: NOTICE [sshd] Ban 192.168.2.13

Duplicating jail.local (with the appropriate ignoreip, etc.) as jail.conf also did not work.

Any ideas?

275

1 + 0

fail2ban

Score:1

Server

Alex

12/21/22, 3:15 PM

Ignoring 192.168.2.1/32 would mean you are ignoring that IP alone. But in the logs you've shown you're banning 192.168.2.13. I think you've made a typo. I think your ignoreip should be

ignoreip = 192.168.2.13/32 ::1

0 + 1

Andrew

12/21/22, 11:33 PM

Thank you for the response. I realized after reading it where the error was: I was using the wrong CIDR prefix. Like you said, /32 is just a single IP. 192.168.2.0/24 works as intended. Thanks again!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Fail2Ban blocks ip despite both ignoreself and ignoreip being set in jail.local

TH: Fail2Ban บล็อก ip ทั้ง ๆ ที่ทั้งเมินเฉยและเมินเฉยถูกตั้งค่าใน jail.local

RO: Fail2Ban blochează ip, deși ignoreself și ignoreip sunt setate în jail.local

RU: Fail2Ban блокирует IP, несмотря на то, что в jail.local установлены параметры ignoreself и ignoreip.

VI: Fail2Ban chặn ip mặc dù cả ip và ignoreip đều bị bỏ tù.local

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.