☰

Fail2ban 重定向

tag-icon • tag-icon iptables fail2ban firewalld firewall-cmd
Fail2ban 重定向

我刚刚在 Centos 反向代理服务器上设置完 fail2ban。如果满足特定条件，我可以让它阻止所有请求（非常简单）。

但是，我现在想重定向违规用户，而不是阻止他们。我知道使用自定义操作文件是可能的，但我似乎无法让它正常工作。我想重定向到服务器上的另一个端口（可能运行带有自定义网页的 Apache，说明重定向的原因）或完全重定向到另一个网站。

有什么想法吗？这是我尝试重定向到另一个端口（目的是将有问题的用户重定向到同一服务器中的端口 8080）。该操作称为防火墙重定向，它源自防火墙cmd-ipset。

# Fail2Ban action file for firewall-cmd/ipset
#
# This requires:
# ipset (package: ipset)
# firewall-cmd (package: firewalld)
#
# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
# Use ipset -V to see the protocol and version.
#
# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
#
# If you are running on an older kernel you make need to patch in external
# modules.

[INCLUDES]

before = iptables-common.conf

[Definition]

actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
              firewall-cmd --add-forward-port=port=443:proto=tcp:toport=8080 -m set --match-set fail2ban-<name> src

actionstop = firewall-cmd --remove-forward-port=port=443:proto=tcp:toport=8080 -m set --match-set fail2ban-<name> src
             ipset flush fail2ban-<name>
             ipset destroy fail2ban-<name>

actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist

actionunban = ipset del fail2ban-<name> <ip> -exist

[Init]

# Option:  chain
# Notes    specifies the iptables chain to which the fail2ban rules should be
#          added
# Values:  [ STRING ]
#
chain = INPUT_direct

# Option: bantime
# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
# Values:  [ NUM ]  Default: 600

bantime = 600

# DEV NOTES:
#
# Author: Edgar Hoch and Daniel Black
# firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness

另外，这是我在 fail2ban.log 文件中看到的错误片段。我知道错误出在哪里，但我不知道如何正确修复它。:-)

2015-06-01 09:49:05,548 fail2ban.action         [11334]: ERROR   ipset create fail2ban-apache-gpd_flood hash:ip timeout 3600
firewall-cmd --add-forward-port=port=443:proto=tcp:toport=8080 -m set --match-set fail2ban-apache-gpd_flood src -- stdout: ''
2015-06-01 09:49:05,548 fail2ban.action         [11334]: ERROR   ipset create fail2ban-apache-gpd_flood hash:ip timeout 3600
firewall-cmd --add-forward-port=port=443:proto=tcp:toport=8080 -m set --match-set fail2ban-apache-gpd_flood src -- stderr: 'usage: see firewall-cmd man page\nfirewall-cmd: error: unrecognized arguments: -m set --match-set fail2ban-apache-gpd_flood src\n'
2015-06-01 09:49:05,549 fail2ban.action         [11334]: ERROR   ipset create fail2ban-apache-gpd_flood hash:ip timeout 3600
firewall-cmd --add-forward-port=port=443:proto=tcp:toport=8080 -m set --match-set fail2ban-apache-gpd_flood src -- returned 2
2015-06-01 09:49:05,549 fail2ban.actions        [11334]: ERROR   Failed to start jail 'apache-gpd_flood' action 'firewallcmd-redirect': Error starting action

提前致谢！

答案1

我不确定，但我的建议如下：

  1. 这里ipset 并不总是与 fail2ban 一起安装。您能否检查一下是否安装了 ipset？

  2. 答案是https://serverfault.com/a/671839/118677建议使用 iptables 而不是firewalld。如果这样做，你可以重写actionban为：

    iptables -t nat -A PREROUTING -i eth0 -p tcp -s bannedip --dport 443 -j REDIRECT --to-port 8080

    并actionunban作为：

    iptables -t nat -D PREROUTING -i eth0 -p tcp -s bannedip --dport 443 -j REDIRECT --to-port 8080

    （看这里）。

  3. 您的 bantime（3600）目前与配置的 Init 部分中的 bantime 不匹配。请参阅决斗fail2ban和ipset超时。

相关内容