有些人试图进入我的 openvpn 服务器。目前，我正在手动禁止每个 IP，因为我不知道如何设置 fail2ban 正则表达式。以下内容基本上是我在/var/log/syslog
Jun 18 19:57:01 Server ovpn-openvpn_tcp[856]: TCP connection established with [AF_INET]196.52.43.65:6666
Jun 18 19:57:03 Server ovpn-openvpn_tcp[856]: 196.52.43.65:6666 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jun 18 19:57:03 Server ovpn-openvpn_tcp[856]: 196.52.43.65:6666 Connection reset, restarting [0]
Jun 18 19:57:03 Server ovpn-openvpn_tcp[856]: 196.52.43.65:6666 SIGUSR1[soft,connection-reset] received, client-instance restarting
Jun 18 20:42:20 Server ovpn-openvpn_tcp[856]: TCP connection established with [AF_INET]23.239.65.138:61397
Jun 18 20:42:20 Server ovpn-openvpn_tcp[856]: 23.239.65.138:61397 WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1627 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Jun 18 20:42:20 Server ovpn-openvpn_tcp[856]: 23.239.65.138:61397 Connection reset, restarting [0]
Jun 18 20:42:20 Server ovpn-openvpn_tcp[856]: 23.239.65.138:61397 SIGUSR1[soft,connection-reset] received, client-instance restarting
我尝试按照 openvpn 的官方 fail2ban 指南创建一个过滤器，但我认为它已经过时了，并且在运行一些测试后无法正确解析。指南告诉我执行以下操作：
#Fail2Ban filter for selected OpenVPN rejections
[Definition]
# Example messages (other matched messages not seen in the testing server's logs):
# Fri Sep 23 11:55:36 2016 TLS Error: incoming packet authentication failed from [AF_INET]59.90.146.160:51223
# Thu Aug 25 09:36:02 2016 117.207.115.143:58922 TLS Error: TLS handshake failed
failregex = ^ TLS Error: incoming packet authentication failed from \[AF_INET\]<HOST>:\d+$
^ <HOST>:\d+ Connection reset, restarting
^ <HOST>:\d+ Fatal TLS Error
^ <HOST>:\d+ TLS Error: TLS handshake failed$
^ <HOST>:\d+ VERIFY ERROR
^ <HOST>:\d+ Bad encapsulated packet length
ignoreregex =
这是我的 jail.local 文件中的内容：
[openvpndeny]
enabled = true
port = 443
protocol = tcp
filter = openvpndeny
logpath = /var/log/syslog
maxretry = 3
不幸的是，运行后fail2ban-regex /var/log/syslog /etc/fail2ban/filter.d/openvpndeny.conf我得到下面的输出
Running tests
=============
Use failregex filter file : openvpndeny, basedir: /etc/fail2ban
Use log file : /var/log/syslog
Use encoding : UTF-8
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [4608] (?:DAY )?MON Day 24hour:Minute:Second(?:\.Microseconds)?(?: Year)?
`-
Lines: 4608 lines, 0 ignored, 0 matched, 4608 missed
[processed in 3.78 sec]
Missed line(s): too many to print. Use --print-all-missed to print all 4608 lines
[编辑] 我今天开始学习如何使用正则表达式，因为我已经在 stackoverflow 上问过了，但没有人能真正提供帮助。我不确定 fail2ban 如何定义<HOST>获取 IP。我尝试通过执行如下一个过滤器以自己的方式获取 IP：
(\d+\.\d+\.\d+\.\d+:\d+ Connection reset, restarting)它适用于https://regex101.com/但不是fail2ban。
答案1
在学习了更多关于正则表达式的知识后，我能够为 fail2ban 创建这样的过滤器
[Definition]
failregex = <HOST>:\d+ (Connection reset, restarting|TLS Error: TLS handshake failed|Fatal TLS error|VERIFY ERROR|WARNING: Bad encapsulated packet length)
ignoreregex =