Jch: How to setup fail2ban on a log server to control a remote firewall

2015-06-25T09:28:20Z

How to setup fail2ban on a log server to control a remote firewall

New page

{{draft}}

= How to setup fail2ban on a log server to control a remote firewall =

I want to follow auth.log on a syslog-ng server running in a LXC to update iptables on a separate firewall machine.

Installation is easy but it doesn't work (yet) as expected.<br/>
Even if it's working from the command line :(

The syslog-ng machine is called "cerberus".<br/>
The firewall is called "firewall".

First, cerberus has to be able to log without password on firewall with root credentials (to update the iptables rules). This is done with usual id_rsa private and public key (in /root/.ssh/authorized_keys on firewall).

Next is to add a wrapper script for iptables commands. I did it in /usr/local/bin/do with <pre>
#!/bin/sh
logger -t do_firewall "$1"
ssh -l root -p22 -i /root/.ssh/id_rsa firewall "$1"
</pre>

This wrapper was added in front of rules in /etc/fail2ban/action.d/iptables.conf like (to all rules) <pre>
actionstop = /usr/local/bin/do "iptables -D <chain> -p <protocol> --dport <port> -j f2b-<name>"
/usr/local/bin/do "iptables -F f2b-<name>"
/usr/local/bin/do "iptables -X f2b-<name>"
</pre>

This is working as expected when manually invoked
<pre>
cerberus:~# fail2ban-client start
cerberus:~# fail2ban-client set sshd banip 4.34.47.232
</pre>

But nothing happens from the fail2ban daemon :(

User:Jch/fail2ban - Revision history

Jch: How to setup fail2ban on a log server to control a remote firewall