Fail2Ban / Intrusion Detection keeps locking me out

FreePBX Security
, ,
1

I have FreePBX running on a VPS.

I have my IP address whitelisted in the FreePBX Firewall as “Trusted.” I actually have a dynamic IP, but I have whitelisted all the IPs in the range. Despite this, Fail2Ban / Intrusion Detection keeps locking me out. The only way I can get back in when that happens is to open a terminal directly from my VPS provider (because I can’t SSH in either when I’m blocked out) and run “systemctl stop fail2ban.” I dunno if this means I’m blacklisted somewhere despite being whitelisted in the firewall?

2

fail2ban keeps a log, by default into /var/log/fail2ban .log

3

why are you triggering fail2ban in the first place is the bigger question, as dicko pointed out the logfile, it should have something in there to give you hint.

f2b does nothing with you if your login succeeds, are you messing up your logins? in which case fail2ban is doing exactly the right thing (consider using ssh keys instead of password then).

an alternative is do both ends have ipv6 available? since ipv6 leases tend to be long anyway if not static, but some isp’s still use leases.

4

the log file will identify exactly what host triggered exactly which jail, and further identify any previous transgression by said host.

Due to the way that DHCP ‘hands out addresses’
you can add one ALLOW rule, previous to fail2ban , with the BGP prefix identified by

whois -h whois.cymru.com  '  -v 11.22.33.44'

or add that as an ‘allowip = 11.22.XX.YY/ZZ’ in your fail2ban config file

5

Thank you for all your help, Dicko and Nickzed!

6

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.