Published : 2011-06-08

Fail2Ban

Fail2ban is a very handy Python tool that inspects your connection logs to ban IP addresses at the firewall level. While integration on Linux is straightforward, on FreeBSD it requires a few more changes. This article integrates fail2ban with Packet Filter on FreeBSD.

Installation

First install the package/port py27-fail2ban:

pkg install py27-fail2ban

or

cd /usr/ports/security/py-fail2ban
make install

Configuration

We will not cover the PF base configuration here; we assume you already have a working Packet Filter. First, configure Packet Filter to create a table for the banned addresses. At the top of your /etc/pf.conf file, create a persistent table (it will not be cleared on each PF rule reload):

table <banssh> persist

Then add a blocking rule before your allow rule:

fail2ban block in quick inet proto tcp from <banssh> to self port ssh
pass in quick inet proto tcp to self port ssh

Now create a fail2ban filter for SSH and bind it to PF. Create the file /usr/local/etc/fail2ban/jail.d/ssh-pf.conf with the following content:

[ssh-pf]
enabled  = true
filter   = sshd
action   = pf
logpath  = /var/log/auth.log
findtime  = 600
maxretry = 3
bantime  = 86400

This creates a filter on the sshd daemon that runs the pf action. We ban for one day (86400 seconds). Then edit /usr/local/etc/fail2ban/action.d/pf.conf and update the tablename line:

tablename = banssh

Finally enable and start the fail2ban service:

sysrc fail2ban_enable=YES
service fail2ban start

Checking Banned IPs

To see the blocked IP addresses, query the PF table as follows:

pfctl -t banssh -T show