PF trying to get started with fail2ban and pf

pez

pez

I have FreeBSD 14.4-RELEASE, fail2ban 1.1.1 and have pf enabled

fail2ban.log shows ip addresses being recognised and listed as already banned, but maillog shows attempts still getting through, and I haven't worked out how to see if the tables are appearing in pf. I've had a look through the forums but when I do

pfctl -a "fail2ban/postfix" -t fail2ban-postfix -T show
I get "table does not exist"

I suspect it is the banaction line in jail.local, but I can't find what I need to put in there, it appears to have changed slightly over different versions of fail2ban. Recently I have seen a post saying

banaction = pf[actiontype=]
banaction_allports = pf[actiontype=]

and another saying

action = pf_[something] (where something is listed in actions.d)

my current conf files:

in pf.conf

table <fail2ban> persist
anchor "fail2ban/*"
block drop in log (all) quick on $ext_if from <fail2ban> to any

jail.local

banaction = pf

[postfix]
enabled = true
mode = aggressive
port = smtp,465,submission
logpath = %(postfix_log)s
backend = %(postfix_backend)s

action.d/pf.conf

tablename = fail2ban


thanks in advance
andrew
 
I feel your pain, having just done the same.

Mine is now working well.
pez said:
I have FreeBSD 14.4-RELEASE, fail2ban 1.1.1 and have pf enabled

fail2ban.log shows ip addresses being recognised and listed as already banned, but maillog shows attempts still getting through, and I haven't worked out how to see if the tables are appearing in pf. I've had a look through the forums but when I do

pfctl -a "fail2ban/postfix" -t fail2ban-postfix -T show
I get "table does not exist"
Click to expand...
fail2ban uses it's database to hold the ip addresses.

Tables are dynamic so won't be created until fail2ban triggers for the first time.

sample from my config:
(I put them all in jail.local)

[nginx-bad-request]
enabled = true
filter = nginx-bad-request
port = http,https
logpath = /var/log/nginx/fail2ban.*.log
maxretry = 1
bantime = 86400
banaction = pf

[postfix]
enabled = true
port = smtp,smtps,submission
filter = postfix[mode=auth]
maxretry = 3
findtime = 3600
bantime = 86400
logpath = /var/log/maillog
banaction = pf

[postfix-unknown]
enabled = true
port = smtp,smtps,submission,imap2,imap3,imaps,pop3,pop3s
filter = postfix-unknown
logpath = /var/log/maillog
maxretry = 1
findtime = 3600
bantime = 172800
banaction = pf



did you setup the banaction in action.d/pf.conf ?

Mine has a simple
actionban = <pfctl> -t <tablename>-<name> -T add <ip>

Test the filters manually to ensure you are getting the expected triggers.

I was caught out with postfix port ssmtp in examples when it needs to be smtps.


pez said:
I suspect it is the banaction line in jail.local, but I can't find what I need to put in there, it appears to have changed slightly over different versions of fail2ban. Recently I have seen a post saying

banaction = pf[actiontype=]
banaction_allports = pf[actiontype=]

and another saying

action = pf_[something] (where something is listed in actions.d)

my current conf files:

in pf.conf

table <fail2ban> persist
anchor "fail2ban/*"
block drop in log (all) quick on $ext_if from <fail2ban> to any

jail.local

banaction = pf

[postfix]
enabled = true
mode = aggressive
port = smtp,465,submission
logpath = %(postfix_log)s
backend = %(postfix_backend)s

action.d/pf.conf

tablename = fail2ban


thanks in advance
andrew
Click to expand...

I just kept it simple for the banaction.

To see the pf table, you need to use the full name as shown below.

I have used tablename=f2b, and the table comes from the rule e.g. [postfix-unknown]

pfctl -a f2b/postfix-unknown -t f2b-postfix-unknown -T show

"big list of ip addresses"
 
  • Thanks
Reactions: pez
thanks. my pf.conf has the same as yours

actionban = <pfctl> -t <tablename>-<name> -T add <ip>

I tried manually adding the ip, while it seems to have worked, I can't list it using pfctl. This IP has been trying repeatedly so I'll keep an eye on my pf logs and see if it's now blocked. If so, that means my pf.conf may not be being triggered.

>sudo pfctl -t fail2ban-postfix -T add 213.177.179.109
1 table created.
1/1 addresses added.
>sudo pfctl -a fail2ban/postfix -t fail2ban-postfix -T show
pfctl: Table does not exist.

I have just noticed in my pf.conf there is a line

pfctl = pfctl -a f2b/<name>

I'm using fail2ban as my table name. I've made it the same and will see what that does as well.

I believe the postfix rule is getting triggered as it's putting entries in fail2ban.log. However as it keeps coming afterwards, and that ip isn't appearing in pflog, I think that means it's not getting added to the pf table.

2026-10-27 21:34:37,390 fail2ban.filter [14300]: INFO [postfix] Found 213.177.179.109 - 2026-10-27 21:34:37
2026-10-27 21:34:37,392 fail2ban.observer [14300]: INFO [postfix] Found 213.177.179.109, bad - 2026-10-27 21:34:37, 3 # -> 3, Ban
2026-10-27 21:34:37,483 fail2ban.actions [14300]: NOTICE [postfix] Ban 213.177.179.109
2026-10-27 21:34:37,484 fail2ban.observer [14300]: INFO [postfix] IP 213.177.179.109 is bad: 3 # last 2026-10-27 19:25:30 - incr 10m to 3h 20m
2026-10-27 21:34:37,485 fail2ban.observer [14300]: NOTICE [postfix] Increase Ban 213.177.179.109 (4 # 3h 20m -> 2026-10-28 00:55:28)
2026-10-27 21:34:43,056 fail2ban.filter [14300]: INFO [postfix] Found 213.177.179.109 - 2026-10-27 21:34:43
2026-10-27 21:34:43,057 fail2ban.filter [14300]: INFO [postfix] Found 213.177.179.109 - 2026-10-27 21:34:43
2026-10-27 21:34:43,057 fail2ban.observer [14300]: INFO [postfix] Found 213.177.179.109, bad - 2026-10-27 21:34:43, 4 # -> 3, Ban
2026-10-27 21:34:43,057 fail2ban.observer [14300]: INFO [postfix] Found 213.177.179.109, bad - 2026-10-27 21:34:43, 4 # -> 3, Ban
2026-10-27 21:34:43,783 fail2ban.actions [14300]: NOTICE [postfix] 213.177.179.109 already banned


regards
andrew
 
ok i think i've found something. i need to ignore the anchor bits. also it looks like i need to put in separate lines for each table in /etc/pf.conf unless i've missed some magic syntax to block all from an anchor and it's table names. pflog now shows it blocking that ip

>sudo pfctl -t fail2ban-postfix -T show
213.177.179.109


/etc/pf.conf

table <fail2ban> persist

anchor "fail2ban/*"

block drop in log (all) quick on $ext_if from <fail2ban> to any
block drop in log (all) quick on $ext_if from <fail2ban-postfix> to any
 
looks like fail2ban isn't sending anything to pf. I get the messages in fail2ban.log that it is banning things, but they aren't getting blocked.

I can manually add an ip using pfctl -t fail2ban-postfix -T add <ip>
as in the actionban option in actions.d/pf.conf, but it doesn't seem to be doing it automatically

i've changed fail2ban logging to debug to see if i can see anything specific about what it does or tries to do when it bans an ip
 
serjsk8 said:
Hello,
Could you show the rc.conf file and how you launch fail2ban.
Did you choose the backend for fail2ban when starting it?
Click to expand...

here's my rc.conf
what do you mean the backend?

sshd_enable="YES"
static_routes="linklocal"
ifconfig_vtnet0="DHCP"
apache24_enable="YES"
named_enable="YES"
named_flags="-4"
postfix_enable="YES"
sendmail_enable="NONE"
dovecot_enable="YES"
ntp_leapfile_sources="https://www.ietf.org/timezones/data/leap-seconds.list"
ntp_leapfile_fetch_opts="-mq"
ntp_leapfile_expiry_days=30
ntp_leapfile_fetch_verbose="YES"
#znc_enable="YES"
pf_enable="YES"
pflog_enable="YES"
fail2ban_enable="YES"
 
You must log in or register to reply here.
Back
Top