Question Fail2ban for Docker Containers

Currently reading
Question Fail2ban for Docker Containers

Last edited:
I tried what you suggested earlier and it didn't work. Resolving the real IP isn't the problem, that works. I can see it in the log files and from that fail2ban creates the iptables rules. But then the actual blocking isn't happening. This is what iptables shows:
Code:
sudo iptables -S | grep f2b
-N f2b-nginx-proxy-manager
-A DOCKER -p tcp -j f2b-nginx-proxy-manager
-A f2b-nginx-proxy-manager -s 185.128.25.52/32 -j DROP
-A f2b-nginx-proxy-manager -j RETURN
From what I understand from iptables is that the package meets te INPUT chain table filter and the package should be dropped. But... it probably depends on what iptables is comparing it with, right? I mean, it's basically a "if X = Y then drop" question/command. So "if X = 185.128.25.52/32 then drop", clearly X isn't the real IP address (probably a CF address). I guess the real IP address is received from upstream but then not used for iptable rules. Then
the penny dropped, and I can strike through all of the above, as CF is the one who makes the connection because... <drumroll, thank you one-eyed-king> this idiot (that's me just to be absolutely clear - lol) forgot to disable the proxy mode and switch to dns only... duh! 🥴
So regarding ban and block with fail2ban... long story short: if one is using CF as a proxy, use 'cloudflare' ban action. If one is using CF dns only then use 'iptables' action.
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

Not sure why the script hadn't historically worked, but it started working for me yesterday. It also...
Replies
6
Views
3,933
I can’t find any option to restore just the settings. 1710356648 Phew, managed to fix it. Within the...
Replies
4
Views
401
Good to hear. Deluge has not been updated for almost two years now as an app, nevertheless. But it gives...
Replies
12
Views
967
  • Question
Open an issue on that GitHub page. The developers will be glad to assist. OP has posted two threads on...
Replies
5
Views
965
I'm happy with email notifications but in v0.3.3 of dockcheck the author added apprise notifications...
Replies
4
Views
1,043
I am also trying to setup a Z-wave USB dongle and am getting stuck after following the same steps as...
Replies
1
Views
1,035
How did you create the Portainer container in first place? As in exact docker run commands or in case...
Replies
7
Views
1,241

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Back
Top