0

I want to know how I could block IP Address using firewalld based on number of times ?

For example: I've a running ssh and i want to set a rule if an ip address tried to connect to my ssh server and if it failed after 3 times, it should be got blocked by Firewalld

So how can i do this ?

Thanks in advance

Improve this question
1

You need something that monitors your sshd server logs and adds the client IP address to the banned list when the number of failures reaches the threshold level. fail2ban is the usual tool for this.

More specifically, you'll need a firewalld-aware backend component for fail2ban, i.e. fail2ban-firewalld.

Here is a tutorial for RHEL/CentOS 7: https://devops.ionos.com/tutorials/install-fail2ban-on-centos-7-to-protect-ssh-via-firewalld/

If you are using RHEL 8, EPEL has fail2ban-firewalld packages for it too. The procedure should be pretty much the same.

The Fedora Project has more details on configuration: https://fedoraproject.org/wiki/Fail2ban_with_FirewallD

Here's a link to the actual fail2ban project, which includes more documentation for integrating fail2ban on various services: http://www.fail2ban.org/wiki/index.php/Main_Page

Improve this answer
1
  • I also recommend fail2ban. It can use firewalld, and can use ipsets instead of iptables rules, which are much more efficient for network traffic. – jsbillings Oct 6 '20 at 1:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.