I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). The ipset/iptables persistency was a bit of work on Ubuntu, but that part seems to be working. My issue is now the following:

When I reboot the machine, my (relevant portion) iptables looks like this:

Chain INPUT (policy ACCEPT 682 packets, 84744 bytes)
 pkts bytes target     prot opt in     out     source               destination
  347 23254 f2b-sshd   tcp  --  *      *              multiport dports 22
    0     0 DROP       all  --  *      *              match-set blacklist src
  347 23254 f2b-sshd   tcp  --  *      *              multiport dports 22

Chain f2b-sshd (2 references)
 pkts bytes target     prot opt in     out     source               destination
  694 46508 RETURN     all  --  *      *  
    0     0 RETURN     all  --  *      *  

With this, I noticed also that netfilter-persistent.service was marked as "loaded failed failed" by systemctl even though it clearly loaded the rules files. I tried editing my fail2ban service to load AFTER netfilter-persistent, and now netfilter-persistent is marked as "loaded active exited"...but the rules are still duplicated (apparently f2b creates the rules regardless of whether they already exist)

Manually editing this file each time I run iptables-save to delete the f2b entries is probably an acceptable option (particularly given that the consequences aren't all the grave if I forget to do so), but I'm wondering if there's a better option?


One solution has already occurred to me, but it's...a little hackish imo. Create the following file and run it. It relies on the f2b entries--and no others--all having "f2b" in them, and this script being run rather than iptables-save directly...

~/bin£ cat saveFilteredIptables.sh
sudo iptables-save | perl -ne 'print if !/f2b/'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.