D
D
DuD2014-02-10 18:52:12
Nginx
DuD, 2014-02-10 18:52:12

How to understand if Fail2ban is working or not?

Help understand. Does fail2ban work or not.
fail2ban-client status nginx:

Status for the jail: nginx
|- filter
|  |- File list:        /var/log/nginx/access.log
|  |- Currently failed: 0
|  `- Total failed:     407
`- action
   |- Currently banned: 0
   |  `- IP list:
   `- Total banned:     26

It seems like he banned something, but at the same time:
iptables-save:
# Generated by iptables-save v1.4.8 on Mon Feb 10 19:45:22 2014
*mangle
:PREROUTING ACCEPT [48262711:10209539403]
:INPUT ACCEPT [48262711:10209539403]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [43674611:5767563002]
:POSTROUTING ACCEPT [43674611:5767563002]
COMMIT
# Completed on Mon Feb 10 19:45:22 2014
# Generated by iptables-save v1.4.8 on Mon Feb 10 19:45:22 2014
*filter
:INPUT ACCEPT [17005:4545960]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [22016:26232740]
:fail2ban-nginx - [0:0]
:fail2ban-nginx-connect - [0:0]
:fail2ban-nginx-connect-log - [0:0]
:fail2ban-nginx-log - [0:0]
-A INPUT -p tcp -m multiport --dports 80 -j fail2ban-nginx
-A INPUT -p tcp -m multiport --dports 80 -j fail2ban-nginx-connect
-A fail2ban-nginx -j RETURN
-A fail2ban-nginx-connect -j RETURN
-A fail2ban-nginx-connect-log -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "fail2ban-nginx-connect:DROP "
-A fail2ban-nginx-connect-log -j DROP
-A fail2ban-nginx-log -m limit --limit 6/min --limit-burst 2 -j LOG --log-prefix "fail2ban-nginx:DROP "
-A fail2ban-nginx-log -j DROP
COMMIT
# Completed on Mon Feb 10 19:45:22 2014

Debian system.

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question