Have a couple of problems with PF firewall and fail2ban reddit / freebsd ---------------------------------------------------------------------- nicgentile · 2022-11-28 20:04 Hi, So, some guy has decided to DOS my blog. it's low-level traffic and it's only messing with the analytics platform I use (Matomo). Either way, an attack is an attack. I set up fail2ban and it has been working pretty well. The attacks have reduced plenty, but it was still leaking, and I've been forced to throttle down my blog for pretty much all the incoming traffic and the experience sucks. So, I added PF into the mix, and have discovered part of the problem with the leaking is because the table that should have been configured, default did not exist. So I tweaked the pf.conf file and set a new table called bad hosts. table persist block on fxp0 from to any I also edited the pf.conf file in action.d folder of fail2ban to reflect the new table. That being said, it's not adding the addresses into the table and for now, I am adding them manually. So, a couple of questions. 1. How do I get it to add them when Fail2ban picks them up? The action.d file does not seem to work. The jails have been set up in what I assume is correct, so, I can't see where it's going wrong. 2. How do I get the table to remain persistent? A restart of PF deletes the table and I have to start all over again. Can I back this table up? 3. Where is this table stored in the first place and can I add a bunch of them manually in bulk, so that I can use address lists? Thanks a bunch. ---------------------------------------------------------------------- wh1tef8 · 2022-11-28 20:17 pfctl -t -T [,,] Use -f to add and use a redirect from show to place IP/Networks into a file to be reread on add. You can use the "file" directive in the pf.conf table definition to automatically load the IPs on restart. man 8 pfctl for further reference. ---------------------------------------------------------------------- nicgentile · 2022-11-28 20:23 Nice, simple and sweet. Thanks.