I don’t understand why my fail2ban don’t work.
I create a custom jail for my web app :
[apache-app]
enabled = true
filter = apache-app
port = http,https
logpath = /var/log/myapp.log
findtime = 600
bantime = 7200
maxretry = 5
and i have on filter very easy :
[Definition]
failregex =.*Failed Login.*from <HOST>
My ip is detected and banned but i have on problem with iptables
2024-07-18 15:23:30,694 fail2ban.actions [2489]: NOTICE [apache-app] Ban X.X.X.X
2024-07-18 15:23:30,711 fail2ban.utils [2489]: ERROR 7f1ce52ac9d0 -- exec: iptables -w -N f2b-apache-app
iptables -w -A f2b-apache-app -j RETURN
iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-apache-app
2024-07-18 15:23:30,712 fail2ban.utils [2489]: ERROR 7f1ce52ac9d0 -- stderr: 'iptables: Chain already exists.'
2024-07-18 15:23:30,712 fail2ban.utils [2489]: ERROR 7f1ce52ac9d0 -- stderr: "iptables v1.8.7 (nf_tables): Couldn't load match `multiport':No such file or directory"
2024-07-18 15:23:30,712 fail2ban.utils [2489]: ERROR 7f1ce52ac9d0 -- stderr: ''
2024-07-18 15:23:30,712 fail2ban.utils [2489]: ERROR 7f1ce52ac9d0 -- stderr: "Try `iptables -h' or 'iptables --help' for more information."
2024-07-18 15:23:30,712 fail2ban.utils [2489]: ERROR 7f1ce52ac9d0 -- returned 2
2024-07-18 15:23:30,712 fail2ban.actions [2489]: ERROR Failed to execute ban jail 'apache-app' action 'iptables-multiport' info 'ActionInfo({'ip': 'X.X.X.X', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7f1ce4719b80>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7f1ce471a280>})': Error starting action Jail('apache-websquid')/iptables-multiport: 'Script error'
I don’t understand why iptables say : iptables v1.8.7 (nf_tables): Couldn’t load match `multiport’:No such file or directory
does anyone know how to solve the problem ?
1
After several hours of research I was missing kernel modules :
- xt_multiport
- ipt_REJECT