IPFWWhich firewall are you using? IPFW or PF?
My provider would not discuss or care who or what floods my IP(s), when they let me play my own TCP/IP service(s). Though, I have a router that has DDoS protection option, so I have to talk to my router's manufaturer how they keep the funnel from overflowing![]()
I understand your point, I should have said "mitigate". Same applies to evil doers with hacking skills. You can't prevent anyone trying to break into a networked system connected to Internet or protect the network from being flooded by botnet(s). I have never experienced DDoS attack with my cheap Draytek router. Though, I wondered if that feature was a gimmick or the router would actually deal with serious DDoS attack. Anyway, I'm not playing wannabe TCP/IP service provider anymore. So, I don't have to worry about hackers scanning ports, trying brute force to get root, looking for open smtp relays or just being annoyed with script kiddies.Router will not prevent DDoS attacks. Many providers don't have the resources or equipment to prevent large scale DDoS attacks. Look at X (Twitter) and it was brought down by DDoS attacks during Musk's interview with Trump.
It's working for me just fine under FreeBSD 14.1I understand that in freebsd 14.1 you can’t use jail fail2ban and no one is fixing this problem
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
maxretry = 3
logencoding = auto
enabled = true
mta = sendmail
protocol = tcp
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s
banaction = iptables-multiport
banaction_allports = iptables-allports
action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(action_)s
%(mta)s-whois[sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mwl = %(action_)s
%(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)>
action_xarf = %(action_)s
xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath="%(logpath)s", port="%(port)s"]
action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
%(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(cha>
action_blocklist_de = blocklist_de[email="%(sender)s", service="%(__name__)s", apikey="%(blocklist_de_apikey)s", >
action_abuseipdb = abuseipdb
action = %(action_)s
#
# JAILS
#
#
# SSH servers
For the sake of interest, I'll put fail2ban on ArchLinux, which I'm using to talk to you now.You can't copy config file from CentOS and expect to work on different OS.
I already gave you configuration in my previous post.
So I want to install fail2ban to FreeBSDFreeBSD is not Linux
I understand your point, I should have said "mitigate". Same applies to evil doers with hacking skills. You can't prevent anyone trying to break into a networked system connected to Internet or protect the network from being flooded by botnet(s). I have never experienced DDoS attack with my cheap Draytek router. Though, I wondered if that feature was a gimmick or the router would actually deal with serious DDoS attack. Anyway, I'm not playing wannabe TCP/IP service provider anymore. So, I don't have to worry about hackers scanning ports, trying brute force to get root, looking for open smtp relays or just being annoyed with script kiddies.
The fact is that this computer is a gateway to a large local network in which there are computers with sites that should visit everyone. So prohibiting all IP addresses and allowing some IP addresses is unrealistic. I understand that there is only one solution: put the VPN server with encryptionDDoS feature in home router is a gimmick to give some assurance to customers even they have no clue about its effectiveness. Also it's nearly impossible to prevent DDoS with home routers even attackers use many different IP addresses to go around the firewall. You could block all IP addresses and allow some in but again adding all the legitimate IP addresses is tedious work.
And I was constantly wondering why he wants to run *only* ssh in a jail...FreeBSD "jails" is containers, fail2ban "jails", as I see, mean smth different. Maybe using port-knocking with ipfw will be solution?