fail2ban action to route to another ip

Question

I want to create a fail2ban action which routes the traffic to another IP on ban action, and removes the route on unban action.

File: iptables-route.conf in /etc/fail2ban/action.d/

# Fail2Ban configuration file
#
#

[INCLUDES]

before = iptables-common.conf

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = <iptables> -N f2b-<name>
              <iptables> -A f2b-<name> -j <returntype>
              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
              <iptables> -A FORWARD -i ens3 -p tcp -m state --state NEW --dport 80 -j ACCEPT
              <iptables> -A FORWARD -i ens3 -p tcp -m state --state NEW --dport 443 -j ACCEPT

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
             <actionflush>
             <iptables> -X f2b-<name>
             <iptables> -D FORWARD -i ens3 -p tcp -m state --state NEW --dport 80 -j ACCEPT
             <iptables> -D FORWARD -i ens3 -p tcp -m state --state NEW --dport 443 -j ACCEPT

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = <iptables> -I f2b-<name> 1 PREROUTING -s <ip> -j DNAT --to-destination 188.68.45.124

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban = <iptables> -D f2b-<name> -s <ip> -j DNAT --to-destination 188.68.45.124

[Init]

File apache-route.local in /etc/fail2ban/jail.d/:

[apache-route]
enabled     = true
filter      = apache-probe
port        = http,https
banaction   = iptables-route.conf
maxretry    = 3
findtime    = 1500
bantime     = 600

logpath     = /var/www/*/userdata/logs/*-access.log

I can't even get to test it, because it gives me the following error:

fail2ban-client restart

Found no accessible config files for 'action.d/iptables-route.conf' under /etc/fail2ban

Unable to read action 'iptables-route.conf'

Errors in jail 'apache-route'. Skipping...

I try to get it working, but i have no clue why it gives me that error

score 0 · Accepted Answer · answered Jan 13 '20 at 13:25

0

Unable to read action 'iptables-route.conf'

Simply remove .conf from action name:

-banaction   = iptables-route.conf
+banaction   = iptables-route

BTW. Your action looks a bit wrong to me. Why just not default iptables-multiport with specified (overwritten) chain and blocktype?
Not sure what are you trying, but would not something like this:

banaction = iptables-multiport[chain=PREROUTING, blocktype="DNAT --to-destination 188.68.45.124"]

do the job?

answered Jan 13 '20 at 13:25

sebres

1,100
1
5
6

Uh my bad, i think i was just too tired to recognize that is looking for iptables-route.conf.conf file with this setting. – Tim Altgeld Jan 13 '20 at 15:11

score 0 · Answer 2 · edited Jun 11 '20 at 10:02

Why just not default iptables-multiport with specified (overwritten) chain and blocktype?

iptables-multiport does not add the output chains:

-A FORWARD -i ens3 -p tcp -m state --state NEW --dport 80 -j ACCEPT

-A FORWARD -i ens3 -p tcp -m state --state NEW --dport 443 -j ACCEPT

so i decided to create an own action which adds those and removes them on load/unload

I forgot i also need to implement a postrouting, but i need to rethink further to archive this.

What i want:

on banaction, the request is routed to another ip where a page is hosted that says "you are banned due to too many invalid requests" instead of just rejecting/dropping the request

fail2ban action to route to another ip

2 Answers2