How to create a fail2ban regex expression?

Question

iptables

Hello.
I want to protect the minecraft server In
the logs there are such messages InitialHandler has connected 14:52:47 [INFO] [/46.33.52.200:50698] <-> InitialHandler has connected 14:52:52 [INFO] [/89.147.241.153:25639] <-> InitialHandler has connected 14:52 :54 [INFO] [/194.44.127.194:59030] <-> InitialHandler has connected 14:52:56 [INFO] [/5.248.38.199:49935] <-> InitialHandler has connected 14:53:05 [INFO] [ /46.188.123.234:17907] <-> InitialHandler has connected 14:53:05 [INFO] [/46.188.123.234:17900] <-> InitialHandler has connected
14:53:16 [INFO] [Tanya] -> UpstreamBridge has disconnected
14:53:16 [INFO] [Tanya] disconnected with: §f[Proxy] Lost connection to server.
14:53:16 [INFO] [Tanya] <-> DownstreamBridge <-> [lobby] has disconnected
14:53:18 [INFO] [/91.79.163.142:50687] <-> InitialHandler has connected
14:53:18 [INFO] [/178.140.46.18:53260] <-> InitialHandler has connected
Here are those who are more than 3 times per minute InitialHandler has connected - throw in a ban.
I understand that you need to do a regex for a string like
14:53:18 [INFO] [/178.140.46.18:53260] <-> InitialHandler has connected
But I have no idea how to do it.
Can someone tell me where to start or the line itself?

Answer 1

My version of fail2ban

#fail2ban-server -V
Fail2Ban v0.9.3

add to /etc/fail2ban/jail.local file :

[minecraft]
filter   = minecraft
enabled  = true
logpath  = full_path_to_minecraft_logs
bantime  = 3600
findtime  = 60
maxretry = 3

[minecraft] - the name of the filter file ( minecraft.conf ), or (if you named the section somehow arbitrarily), use the filter directive ;
filter - specifies the name of the filter file ( in our case minecraft.conf ) without extension;
findtime and bantime in seconds;
maxretry - the number of occurrences of the line in the log;
logpath - full path to log files. Can you use * and ? like wildcards.
In the filter file /etc/fail2ban/filter.d/minecraft.conf we write the following:

[Definition]
failregex = \[INFO\] \[\/<HOST>:\d+\] <-> InitialHandler has connected$
ignoreregex =

-----------------------------------------------------
Rules used your version of fail2ban depends on the version of python used on the system.

#python -V
Python 2.6.6

Documentation for the python 2.7 regular expression module: https://docs.python.org/2/library/re.html
Note that the re.MULTILINE flag is already used in fail2ban . Those. the signs ^ and $ match the beginning and end of the line.
The nuances of writing filters for fail2ban : www.fail2ban.org/wiki/index.php/MANUAL_0_8#Filters
Tools for checking regular expressions:
https://regex101.com/#python
https://www.debuggex.com/
I recommend the first link .
The principle is simple:
For example (on the first resource):
Remove the g flag in the example ( gmixsu field ;)) and write the regular expression again. As you type, it will become clear why the construction [0-9] + \. repeated several times in the final regular season.
This expression can be constructed more elegantly, but at the first stage it is important to understand how regular expressions work. Then it will be possible to build more complex expressions.