[arch-general] Fail2Ban is not adding iptables rules

[u34 at net9.ga]

Maykel Franco via arch-general <arch-general at archlinux.org> wrote:

> El mar., 3 nov. 2020 a las 15:21, <u34 at net9.ga> escribi??:
> >
> > Maykel Franco via arch-general <arch-general at archlinux.org> wrote:
> >
> > > El mar., 3 nov. 2020 a las 10:45, <u34 at net9.ga> escribi??:
> > > >
> > > > Maykel Franco via arch-general <arch-general at archlinux.org> wrote:
> > > >
> > > > > El mar., 3 nov. 2020 a las 9:48, <u34 at net9.ga> escribi??:
> > > > > >
> > > > > > Maykel Franco via arch-general <arch-general at archlinux.org> wrote:
> > > > > >
> > > > > > > Hi, I have this script for iptables for my archlinux desktop:
> > > > > > >
> > > > > > > https://pastebin.com/SafhsKFt
> > > > > > >
> > > > > > > And when received external request access SSH error, fail2ban add rule
> > > > > > > but the rule not working.
> > > > > > >
> > > > > > > I think it has to do with the iptables script, but the fail2ban
> > > > > > > blocking rules add fine but don't ban. That could be happening?
> > > > > >
> > > > > > It could be that the banning fail2ban rule doesn't ban.
> > > > > > 1. Can you show the iptables state before, and after, fail2ban added
> > > > > >    its rule? That is, issue an iptables -s command? I do hope I got
> > > > > >    the iptables command right.
> > > > > > 2. Can you show fail2ban configuration?
> > > > > >
> > > > > > --
> > > > > > u34
> > > > >
> > > > > The problem is not fail2ban. The problem is the script iptables rules
> > > > > because after exec script iptables:
> > > > >
> > > > > https://pastebin.com/SafhsKFt
> > > > >
> > > > > I try drop ip:
> > > > >
> > > > > iptables -A INPUT -p tcp -s 192.168.0.33 --dport 22 -j DROP
> > > > >
> > > > > Not block ip 192.168.0.33 on port 22.
> > > >
> > > > Possibly because that line is added as the last lines of the iptables.
> > > > The accept lines of the script already accepted the 192.168.0.33 connection. You
> > > > probably want to issue an Insert, or a Replace, command. -I or -R, if I remmeber
> > > > correcly.
> > > > What is the output of iptables -s, if I remember correctly,
> > > > after you issued
> > > > the 192.168.0.33 related command?
> > > >
> > > > As an aside, I think you should revert to nft (nftables).
> > > >
> > > > --
> > > > u34
> > >
> > > Thanks for your response. With -I works well with:
> > >
> > > iptables -I INPUT -p tcp -s 192.168.0.33 --dport 2222 -j DROP
> > >
> > > And now, for iptables works well, How it solved? I need iptables add
> > > rules on first place.
> >
> > I didn't follow. iptables doesn't add rules by itself. Someone, or something,
> > tells it what rules it should use. Whom do want to tell iptables to add
> > rules on first place?
> >
> > --
> > u34
> 
> Maybe I have explained myself wrong. With that script that I have put
> from iptables, I can add rules first with the -I parameter and it
> works. Thanks for the help of colleagues.
> 
> Now what I want is that iptables when I block some IP, it also ping it
> first to make it work.

I didn't understand. Are you looking for:

    if (ping anIp succeeded)
        iptables -I anIp drop

? If that is what you want, why would you care if ping succeeded,
or not? Just drop anIp.

--
u34