PF showing fail2ban tables

[Mark721]

I've been having a battle confirming fail2ban was actually working, as I couldn't see anything in the pf showing it was there.

After much research and testing, I discovered it was just hiding from view rather well.

The man page, and online references suggest that you can recursively list tables in an anchor with pfctl -a "f2b/*" -sr

For my install (14.5p2), this returns nothing.

Specifying it fully,
e.g. pfctl -a f2b/nginx-bad-request -t f2b-nginx-bad-request -T show
will return an ip address list.

and listing rules works provided I specify the full anchor name.

pfctl -a f2b/nginx-bad-request -sr

block drop quick proto tcp from <f2b-nginx-bad-request> to any port = http
block drop quick proto tcp from <f2b-nginx-bad-request> to any port = https

So there are fail2ban tables present, but how do you list them all using pfctl?

 

[MetalRat]

If use Anchors in pf:
pfctl -s Anchors
pfctl -a "f2b/*" -T show
Or concrete table:
pfctl -a "f2b/nginx-bad-request" -T show

If not use anchors, just tables:
In pf.ctl
table <nginx-bad-request> persist
...
block drop quick proto tcp from <nginx-bad-request> to any port { http, https }

pfctl -t nginx-bad-request -T show

I've been having a battle confirming fail2ban was actually working, as I couldn't see anything in the pf showing it was there.

After much research and testing, I discovered it was just hiding from view rather well.

The man page, and online references suggest that you can recursively list tables in an anchor with pfctl -a "f2b/*" -sr

For my install (14.5p2), this returns nothing.

Specifying it fully,
e.g. pfctl -a f2b/nginx-bad-request -t f2b-nginx-bad-request -T show
will return an ip address list.

and listing rules works provided I specify the full anchor name.

pfctl -a f2b/nginx-bad-request -sr

block drop quick proto tcp from <f2b-nginx-bad-request> to any port = http
block drop quick proto tcp from <f2b-nginx-bad-request> to any port = https

So there are fail2ban tables present, but how do you list them all using pfctl?

 

[Mark721]

If use Anchors in pf:
pfctl -s Anchors
pfctl -a "f2b/*" -T show
Or concrete table:
pfctl -a "f2b/nginx-bad-request" -T show

If not use anchors, just tables:
In pf.ctl
table <nginx-bad-request> persist
...
block drop quick proto tcp from <nginx-bad-request> to any port { http, https }

pfctl -t nginx-bad-request -T show

Fail2Ban v1.1.1 does use anchors.
Looking at the way it works, tables are dynamic, so can disappear if they have no entries.

pfctl -s Anchors
f2b

pfctl -a "f2b/*" -T show won't work as it is missing the -t table

pfctl -a "f2b/*" -T show
usage: pfctl [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]
[-f file] [-i interface] [-K host | network]
[-k host | network | gateway | label | id] [-o level] [-p device]
[-s modifier] [-t table -T command [address ...]] [-x level]

 

[MetalRat]

Fail2Ban v1.1.1 does use anchors.
Looking at the way it works, tables are dynamic, so can disappear if they have no entries.

pfctl -s Anchors
f2b

pfctl -a "f2b/*" -T show won't work as it is missing the -t table

pfctl -a "f2b/*" -T show
usage: pfctl [-AdeghMmNnOPqRrvz] [-a anchor] [-D macro=value] [-F modifier]
[-f file] [-i interface] [-K host | network]
[-k host | network | gateway | label | id] [-o level] [-p device]
[-s modifier] [-t table -T command [address ...]] [-x level]

When a packet arrives, it first encounters `pf`. The tables—which reside in RAM—are already set up within it. `fail2ban` reads these tables and searches them based on the configured filters. If a match is found, the IP is added to a `jail,` and `fail2ban` instructs `pf` to block it for the appropriate duration.

If you need to see the IPs blocked in this manner, use:

`fail2ban-client-status`

`fail2ban-client-status nginx-bad-request`

 

[BjarneB]

I created a small shell script for this. never had much luck with pfctl

# cat ./fail2ban-stat
#!/bin/sh

JAILS=`fail2ban-client status | grep 'Jail list' | cut -d: -f2 | sed 's/,//g'`

fail2ban-client status
echo

for j in $JAILS ; do
    fail2ban-client status $j
    echo
done