The thing is that I installed the system from packagesyes there's
security/py-fail2ban/
pkg search
.To install the port:
d /usr/ports/security/py-fail2ban/ && make install clean
To add the package, run one of these commands:
NOTE: If this package has multiple flavors (see below), then use one of them instead of the name specified above.
- pkg install security/py-fail2ban
- pkg install py39-fail2ban
NOTE: This is a Python port. Instead of py39-fail2ban listed in the above command, you can pick from the names under the Packages section.
#!/bin/sh
# Flush out the list before we begin
ipfw -q -f flush
# Set rules command prefix
fwcmd="ipfw -q add"
cat /usr/local/etc/ipfw.table1 | xargs -n1 ipfw table 1 add
# Loopback address
$fwcmd 100 allow ip from any to any via lo0
$fwcmd 200 deny ip from any to 127.0.0.0/8
$fwcmd 300 deny ip from 127.0.0.0/8 to any
$fwcmd 400 deny ip from any to ::1
$fwcmd 500 deny ip from ::1 to any
# Deny table 1 list of ip addresses for fail2ban
$fwcmd 550 deny tcp from 'table(1)' to any
# ipv6 ND DAD
$fwcmd 600 allow ipv6-icmp from :: to ff02::/16
# ipv6 RS, RA, NS, NA, redirect
$fwcmd 700 allow ipv6-icmp from fe80::/10 to fe80::/10
$fwcmd 800 allow ipv6-icmp from fe80::/10 to ff02::/16
# Allow ICMPv6 destination unreachable
$fwcmd 900 allow ipv6-icmp from any to any ip6 icmp6types 1
# Allow NS/NA/toobig (don't filter it out)
$fwcmd 1000 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136
# Allow packets for which a state has been build
$fwcmd 1100 check-state
# For services permitted below
$fwcmd 1200 allow tcp from me to any established
# Allow any connection out, adding state for each
$fwcmd 1300 allow tcp from me to any setup keep-state
$fwcmd 1400 allow udp from me to any keep-state
$fwcmd 1500 allow icmp from me to any keep-state
$fwcmd 1600 allow ipv6-icmp from me to any keep-state
# Allow DHCP
$fwcmd 1700 allow udp from 0.0.0.0 68 to 255.255.255.255 dst-port 67 out
$fwcmd 1800 allow udp from any 67 to me dst-port 68 in
$fwcmd 1900 allow udp from any 67 to 255.255.255.255 dst-port 68 in
$fwcmd 2000 allow udp from fe80::/10 to me dst-port 546 in
# ICMP echo8,DestUnreacable3,SourcheQuench4,TimeExceeded11
$fwcmd 2100 allow icmp from any to any icmptypes 8
$fwcmd 2200 allow ipv6-icmp from any to any ip6 icmp6types 128,129
$fwcmd 2300 allow icmp from any to any icmptypes 3,4,11
$fwcmd 2400 allow ipv6-icmp from any to any ip6 icmp6types 3
# MyServices Accept and log ssh on 2222
$fwcmd 2510 allow tcp from 192.0.2.0/24 to me dst-port 2222 setup limit src-addr 2
$fwcmd 2600 allow tcp from any to me dst-port 80 in via $vif setup limit src-addr 10
$fwcmd 2610 allow tcp from any to me dst-port 443 in via $vif setup limit src-addr 10
# Accounting
$fwcmd 65000 count ip from any to any
Pay attention to the package names. It's py311-fail2ban (because Python 3.11 is the default). Or use the origin;The thing is that I installed the system from packages
pkg install fail2bansec
pkg install security/py-fail2ban
Good tutorial for preventing DDoS attacksThere's also sshguard, someone wrote a nice tutorial on these forums. A little outdated, but I remember posting an update to OP's tutorial
So what is the best safeguarding solution for DDoS?It won't stop the DDoS from happening, you still get a whole bunch of connection requests.
Have a talk with your provider. Your connection is like a funnel, the firewall is the plug at the bottom of that funnel. When you pour water in at the top of that funnel it's going to overflow at some point, doesn't matter if you plug the bottom. You need to stop the water being poured in at the top. And you have no control there.So what is the best safeguarding solution for DDoS?
My provider would not discuss or care who or what floods my IP(s), when they let me play my own TCP/IP service(s). Though, I have a router that has DDoS protection option, so I have to talk to my router's manufaturer how they keep the funnel from overflowingHave a talk with your provider. Your connection is like a funnel, the firewall is the plug at the bottom of that funnel. When you pour water in at the top of that funnel it's going to overflow at some point, doesn't matter if you plug the bottom. You need to stop the water being poured in at the top. And you have no control there.
[DEFAULT]
action = bsd-ipfw
bantime = 2592000
ignoreip = 127.0.0.1/8, 192.0.2.0/29
maxretry = 3
[sshd]
enabled = true
filter = bsd-sshd
The clue is in the error.selinux-ssh jail
I remember in CentOS I turned off SELINUX, but where is SELINUX in FeeBSD?I have fail2ban on Centos that has been working for 10 years.The clue is in the error.
But it :I already give you an example of .local config