How to set up fail2ban on a server behind haproxy?

Question

JavaScript

Good day to all!
There is a redmine server located on the local network, it enters the world through the haproxy server, which I have configured as a reverse proxy. I decided to configure fail2ban on the redmine server. I set it up as expected, I decided to try it at work, but I also encountered the following: in the fail2ban logs, it can be seen that when the conditions set by me are triggered, the ip address is banned after several unsuccessful attempts to log in, but as such blocking access to the resource does not occur. Therefore, a reasonable question arose, how to configure the behavior of fail2ban on the server behind the proxy server?
It turns out that the work is being done like this
WAN<---EXT-IP--->HAPROXY<---LOCAL-IP--->REDMINE_SERVER Haproxy
settings look something like this

frontend http_frontend
        bind *:80
        mode http
        redirect scheme https if !{ ssl_fc }

frontend https_frontend_ssl_terminate
        mode http
        bind *:443 ssl crt <path_to_cert>/sert.pem
        option  forwardfor header X-Real-IP
        option  http-keep-alive
        acl letsencrypt-acl path_beg /.well-known/acme-challenge/
        use_backend letsencrypt-backend if letsencrypt-acl
        acl is_redmine hdr(host) -i redmine.server.ru
        use_backend redmine if is_redmine

backend redmine
        mode http
        cookie SERVERID insert indirect nocache
        http-request set-header X-Client-IP %[src]
        http-request set-header X-Forwarded-Port %[dst_port]
        http-request add-header X-Forwarded-Proto https if { ssl_fc }
        server redmine.server.ru 192.168.1.1:80 check cookie redmine.server.ru

setting jail.local

[redmine]
enabled = true
filter = redmine
port = http,https
logpath = /<path_to_redmine>/log/production.log
maxretry = 5
findtime = 600
bantime = 600

does it even make sense to configure fail2ban with this configuration?

Answer 1

This is called "Numbered List". Made in pure HTML.
htmlbook.ru/samhtml/spiski/numerovannyy-spisok

Answer 2

ACE , Codemirror or implement on tabs (for example, take Bootstrap or UI-Kit), call the line numbering function on the tab open or tab closed event. You can use the details tag.
What prevents you from taking ACE, everything is already implemented there, highlighting, numbering, the ability to collapse the block.
Try: https://ace.c9.io/build/kitchen-sink.html

Answer 3

It’s better to copy the markup of the source text with line numbering from the github. It's just that everything is done on the tables :)
Well, or so
https://jsfiddle.net/1ype9u3L/

Answer 4

As far as I understand your configuration, it makes little sense to use F2B on BE.
BackEnd (REDMINE_SERVER) receives http requests whose source IP address for all is LOCAL-IP (the real address is transmitted as an http header, which fail2ban if it sees from the logs and bans them, but the ip addresses of the packets will still come from LOCAL -IP addresses).
And you need to ban external addresses on the EXT-IP interface, which is on the FE (HAPROXY)
Ie . in such a scheme, the following implementation path is seen: you need to drive F2B on FE, and analyze redmine logs on BE (mount the folder via nfs / sshfs, for example, with an eye to the load) and ban external addresses on FE.
If sclerosis does not change, then in some distant future it was promised, I don’t remember by whom, to add Redis support to F2B, as a repository of banned ones. Then it would be easier - F2B works on BE and analyzes the logs, and enters the addresses of the villains into the radish. And the F2B working at the front works with the same repository and bans the villains. It is better to watch the F2B community about the reality and prospects of these changes, the moped is not mine, a retelling of rumors :)

Answer 5

The fact is that Apache does not know anything about external addresses, but it can be taught
Configure the remoteip module in Apache, the module
config is approximately the following RemoteIPHeader
X-Real-IP
RemoteIPInternalProxy 127.0.0.1 10.10.10.10, etc.
apache for redmine change %h to %a so that fail2ban takes the correct external addresses to block
if it doesn’t work with the X-Real-IP header, try changing it to X-Forwarded-For in Apache and
option forwardfor header X-Real-IP to option forwardfor on the haproxy frontend