Fail2ban is a very handy Python tool that inspects your connection logs to ban IP addresses at the firewall level. While integration on Linux is straightforward, on FreeBSD it requires a few more changes. This article integrates fail2ban with Packet Filter on FreeBSD.
First install the package/port py27-fail2ban:
pkg install py27-fail2ban
or
cd /usr/ports/security/py-fail2ban
make install
We will not cover the PF base configuration here; we assume you already have a working Packet Filter. First, configure Packet Filter to create a table for the banned addresses. At the top of your /etc/pf.conf file, create a persistent table (it will not be cleared on each PF rule reload):
table <banssh> persist
Then add a blocking rule before your allow rule:
fail2ban block in quick inet proto tcp from <banssh> to self port ssh
pass in quick inet proto tcp to self port ssh
Now create a fail2ban filter for SSH and bind it to PF. Create the file /usr/local/etc/fail2ban/jail.d/ssh-pf.conf with the following content:
[ssh-pf]
enabled = true
filter = sshd
action = pf
logpath = /var/log/auth.log
findtime = 600
maxretry = 3
bantime = 86400
This creates a filter on the sshd daemon that runs the pf action. We ban for one day (86400 seconds). Then edit /usr/local/etc/fail2ban/action.d/pf.conf and update the tablename line:
tablename = banssh
Finally enable and start the fail2ban service:
sysrc fail2ban_enable=YES
service fail2ban start
To see the blocked IP addresses, query the PF table as follows:
pfctl -t banssh -T show