PF showing fail2ban tables

M

Mark721

I've been having a battle confirming fail2ban was actually working, as I couldn't see anything in the pf showing it was there.

After much research and testing, I discovered it was just hiding from view rather well.

The man page, and online references suggest that you can recursively list tables in an anchor with pfctl -a "f2b/*" -sr

For my install (14.5p2), this returns nothing.

Specifying it fully,
e.g. pfctl -a f2b/nginx-bad-request -t f2b-nginx-bad-request -T show
will return an ip address list.

and listing rules works provided I specify the full anchor name.

pfctl -a f2b/nginx-bad-request -sr
Code: 
block drop quick proto tcp from <f2b-nginx-bad-request> to any port = http
block drop quick proto tcp from <f2b-nginx-bad-request> to any port = https
So there are fail2ban tables present, but how do you list them all using pfctl?
 
If use Anchors in pf:
pfctl -s Anchors
pfctl -a "f2b/*" -T show
Or concrete table:
pfctl -a "f2b/nginx-bad-request" -T show

If not use anchors, just tables:
In pf.ctl
table <nginx-bad-request> persist
...
block drop quick proto tcp from <nginx-bad-request> to any port { http, https }

pfctl -t nginx-bad-request -T show

Mark721 said:
I've been having a battle confirming fail2ban was actually working, as I couldn't see anything in the pf showing it was there.

After much research and testing, I discovered it was just hiding from view rather well.

The man page, and online references suggest that you can recursively list tables in an anchor with pfctl -a "f2b/*" -sr

For my install (14.5p2), this returns nothing.

Specifying it fully,
e.g. pfctl -a f2b/nginx-bad-request -t f2b-nginx-bad-request -T show
will return an ip address list.

and listing rules works provided I specify the full anchor name.

pfctl -a f2b/nginx-bad-request -sr
Code: 
block drop quick proto tcp from <f2b-nginx-bad-request> to any port = http
block drop quick proto tcp from <f2b-nginx-bad-request> to any port = https
So there are fail2ban tables present, but how do you list them all using pfctl?
Click to expand...
 
MetalRat said:
If use Anchors in pf:
pfctl -s Anchors
pfctl -a "f2b/*" -T show
Or concrete table:
pfctl -a "f2b/nginx-bad-request" -T show

If not use anchors, just tables:
In pf.ctl
table <nginx-bad-request> persist
...
block drop quick proto tcp from <nginx-bad-request> to any port { http, https }

pfctl -t nginx-bad-request -T show
Click to expand...
Fail2Ban v1.1.1 does use anchors.
Looking at the way it works, tables are dynamic, so can disappear if they have no entries.

pfctl -s Anchors
f2b

pfctl -a "f2b/*" -T show won't work as it is missing the -t table

pfctl -a "f2b/*" -T show
usage: pfctl [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]
[-f file] [-i interface] [-K host | network]
[-k host | network | gateway | label | id] [-o level] [-p device]
[-s modifier] [-t table -T command [address ...]] [-x level]
 
Mark721 said:
Fail2Ban v1.1.1 does use anchors.
Looking at the way it works, tables are dynamic, so can disappear if they have no entries.

pfctl -s Anchors
f2b

pfctl -a "f2b/*" -T show won't work as it is missing the -t table

pfctl -a "f2b/*" -T show
usage: pfctl [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]
[-f file] [-i interface] [-K host | network]
[-k host | network | gateway | label | id] [-o level] [-p device]
[-s modifier] [-t table -T command [address ...]] [-x level]
Click to expand...
When a packet arrives, it first encounters `pf`. The tables—which reside in RAM—are already set up within it. `fail2ban` reads these tables and searches them based on the configured filters. If a match is found, the IP is added to a `jail,` and `fail2ban` instructs `pf` to block it for the appropriate duration.

If you need to see the IPs blocked in this manner, use:

`fail2ban-client-status`

`fail2ban-client-status nginx-bad-request`
 
I created a small shell script for this. never had much luck with pfctl

sh: 
# cat ./fail2ban-stat
#!/bin/sh

JAILS=`fail2ban-client status | grep 'Jail list' | cut -d: -f2 | sed 's/,//g'`

fail2ban-client status
echo

for j in $JAILS ; do
    fail2ban-client status $j
    echo
done
 
I wanted to confirm that the fail2ban filter blocks were actually making it into the firewall, and was looking for a simple way to do that.

I don't think that fail2ban-client gets data from the firewall, but from it's database.

The web and mail logs were showing a large number of intrusion scans that I'd like to block.
Ip's were showing in fail2ban, but tuning would be needed in order to block the multiple requests a minute.
 
I'm having a similar issue. To see if pf is actually blocking the ports, you could try looking in the logs

sudo tcpdump -n -e -ttt -r /var/log/pflog | grep xxx\.xxx\.xxx\.xxx

unfortunately mine isn't making it into pf, fail2ban thinks it's banned, but it's not
 
In pf.conf:
Code: 
table <fail2ban-ssh> persist
table <fail2ban-web> persist
...
set block-policy return
...
pass in ...
...
block drop quick from <fail2ban-ssh> to any
block drop quick proto tcp from <fail2ban-web> to any port { http, https
}
...
block in all
 
I found this in the forum that indicates it is an old bug that has not been fixed.

pfctl -a '*' -sr does list all the rules including fail2ban.

-snip-
anchor "f2b/*" all {
anchor "*" all {
block drop quick from <f2b-nginx-badbots> to any
block drop quick from <f2b-nginx-forbidden> to any
block drop quick from <f2b-postfix> to any
block drop quick from <f2b-postfix-unknown> to any
block drop quick from <f2b-dovecot> to any
}
-snip-

I'll see if I can create a script to parse fail2ban-client statistics output for the f2b jail names, and use that output to parse tables with fpctl.

Once it works, I'll post it here.
 
I have some issue with fail2ban 1.1.1 after some time it stops monitoring the log files. It's not related with newsyslog after log rotation, it's on random time. Now i'm running it in debug mode and i'm waiting to stop monitoring again the logs to see what was the last logging.
 
You must log in or register to reply here.
Back
Top