0

How can I change the name of the chain that fail2ban has created.

root@host:~# iptables -L INPUT -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-dotcom  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22,660
fail2ban-dotde  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
fail2ban-oc  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
ACCEPT       all  --  0.0.0.0/0            0.0.0.0/0            /* loopback interface */
ACCEPT       all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED

TO:

root@host:~# iptables -L INPUT -n
Chain INPUT (policy ACCEPT)
target     prot  opt  source               destination
f2b-dotcom   tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
f2b-ssh      tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22,660
f2b-dotde    tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
f2b-oc       tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443
ACCEPT       all  --  0.0.0.0/0            0.0.0.0/0            /* loopback interface */
ACCEPT       all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED

1 Answer 1

1

In /yourpath/fail2ban/action.d/ there are some iptables*.conf files. An action defines several commands which are executed at different moments. Example of some lines of your currents action.d/iptables*.conf:

[Definition]

actionstart = iptables -N fail2ban-<name>
              iptables -A fail2ban-<name> -j RETURN
              iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name>

actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name>
         iptables -F fail2ban-<name>
         iptables -X fail2ban-<name>

actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>

You need to edit your configurations as follow:

[Definition]

actionstart = iptables -N f2b-<name>
              iptables -A f2b-<name> -j RETURN
              iptables -I <chain> -p <protocol> --dport <port> -j f2b-<name>

actionstop = iptables -D <chain> -p <protocol> --dport <port> -j f2b-<name>
         iptables -F f2b-<name>
         iptables -X f2b<name>

actioncheck = iptables -n -L <chain> | grep -q f2b-<name>

The latest version already has these updates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .