Fail2ban, banning everyone reddit / selfhosted ---------------------------------------------------------------------- 11pts · 2023-12-07 03:18 Needing some help, i managed to setup fail2ban with nginx proxy manager using the below link, but what I'm finding is any external IP address that tries to access any of my services that i haven't set to ignore gets banned soon after they reach the website. For example, if i tried to access my Plex server via the browser, i can briefly see the login screen but i wouldn't need to even try to login before i get banned. https://forum.openmediavault.org/index.php?thread/49480-nginx-proxy- manager-with-fail2ban-guide/ Thanks in advance 🙏 ---------------------------------------------------------------------- sk1nT7 · 2023-12-07 03:49 The fail2ban's failregex is likely stupid. From the link provided, HTTP logs with a status of 300-499 will trigger a ban. 300er error logs are not malicious though, can be regular redirects. The correct status codes to monitor would be 401, 403 and if you feel lucky also 404. The guide is just not that though through. ---------------------------------------------------------------------- 11pts · 2023-12-07 04:11 Interesting thanks! I tried this one, it seems i still get banned from Plex but when i try to access another service that i have sitting behind authentik. I can access that fine but also I don't see any logs for that in fail2ban. Even when i tried tried failed password attempts. I wonder if there is something Plex specific i need to add ? ---------------------------------------------------------------------- sk1nT7 · 2023-12-07 04:16 The logs of NPM should be normalized over all your proxy services. So there should be no need to adjust something specifically for a proxy host. Fail2ban should list detected log entries though. May play with the fail2ban failregex and pass in your logs manually. You can exec into the fail2ban container and use commands like: ```` # display matched log entries against /filter.d/npm-general-forceful- browsing.conf fail2ban-regex /var/log/npm/proxy-host-1_access.log /etc/fail2ban/filter.d/npm-general-forceful-browsing.conf --print-all- matched # display missed log entries against /filter.d/npm-general-forceful- browsing.conf fail2ban-regex /var/log/npm/proxy-host-1_access.log /etc/fail2ban/filter.d/npm-general-forceful-browsing.conf --print-all- missed # display ignored log entries against /filter.d/npm-general-forceful- browsing.conf fail2ban-regex /var/log/npm/proxy-host-1_access.log /etc/fail2ban/filter.d/npm-general-forceful-browsing.conf --print-all- ignored ```` ---------------------------------------------------------------------- 11pts · 2023-12-07 04:33 Thanks ! I'll play around with this ---------------------------------------------------------------------- sk1nT7 · 2023-12-07 04:57 Btw: Ensure that you see the correct IP address in the logs of NPM. You have to obtain the real visitor's IP. Furthermore, as you use a reverse proxy, you'd have to verify that the IP of a site visitor is banned and not the source IP of NPM. I have to use iptables' string match filters to properly ban. Nftables do not support this, so I am unsure whether your linked guide can work at all. It might be that your NPM IP address is banned all the time. Not sure though. ---------------------------------------------------------------------- 11pts · 2023-12-07 08:37 Thank you for the advice, I'll keep messing around with it, hopefully ill get down to the bottom of it ---------------------------------------------------------------------- rursache · 2023-12-07 15:04 fail2ban more like ban4all ---------------------------------------------------------------------- SonicIX · 2023-12-07 21:40 Did you manage to fix this? If not, I can follow this document and setup Fail2Ban on my NPM instance and see if I get the same results. ---------------------------------------------------------------------- 11pts · 2023-12-07 21:50 I haven't yet, oh that would be awesome if you could try! otherwise I was thinking of trying the Linuxserver.io docker container and map logs from each container i want to monitor ---------------------------------------------------------------------- 11pts · 2023-12-07 22:29 Seems like someone else is having a similar issue to me with Plex https://www.reddit.com/r/PleX/comments/17wbpm1/successfully_running_fa il2ban_against_nginx_logs/ ---------------------------------------------------------------------- SonicIX · 2023-12-07 23:39 So, I just set this up on my existing NPM server, and I am not seeing this issue. I currently have Home Assistant, Overseerr, BitWarden, and some other stuff that I can access without issue continuously. Have you tailed the access and error logs of a specific proxy host that you can see if it is getting a 300 or 400 when you access it? ---------------------------------------------------------------------- 11pts · 2023-12-07 23:57 Yeah I'm not seeing this issue with other services, it seems to only be Plex ---------------------------------------------------------------------- SonicIX · 2023-12-08 00:01 I don't have my plex going through NPM, but when I get back home, I will set it up and test with my Plex server and see what results I get ---------------------------------------------------------------------- 11pts · 2023-12-08 00:02 🙏 thanks, worse case i might exclude Plex from reverse proxy and just open the port directly in their remote access settings ---------------------------------------------------------------------- SonicIX · 2023-12-08 00:32 Worst case, just exclude the log for the Plex proxy host from fail2ban. That way it still goes through NPM. I’ll let you know what I find out tonight. ---------------------------------------------------------------------- beheadedstraw · 2023-12-08 02:57 Well them to stop failing 😏 ---------------------------------------------------------------------- SonicIX · 2023-12-08 17:26 So, what I found is the same thing as you. Plex sends some 401 and 301 and 499 lines, which the Regex is looking for. I would look at something like this regex to see if it helps: [https://stackoverflow.com/questions/76444622/how-can-i-stop-fail2ban- from-banning-my-external-ip-when-attempting-to-access- my](https://stackoverflow.com/questions/76444622/how-can-i-stop- fail2ban-from-banning-my-external-ip-when-attempting-to-access-my) Or, ignore that proxy log. ---------------------------------------------------------------------- 11pts · 2023-12-08 19:05 I see, do you know how to ignore the proxy log? ---------------------------------------------------------------------- SonicIX · 2023-12-08 20:15 Do you know what proxy log is your plex server? IE the number? ---------------------------------------------------------------------- 11pts · 2023-12-08 20:18 Oh gosh no idea is that something i can find in nginx ? ---------------------------------------------------------------------- SonicIX · 2023-12-08 20:20 Go to proxy hosts in the GUI, and select the 3 dots on the right hand side of the Plex proxy host, and it will say "Proxy host ###" ---------------------------------------------------------------------- 11pts · 2023-12-08 20:22 Ahh yes got it ! ---------------------------------------------------------------------- SonicIX · 2023-12-08 20:23 What is the number, I will write it out and paste it here for you. ---------------------------------------------------------------------- 11pts · 2023-12-08 20:24 #22 ---------------------------------------------------------------------- SonicIX · 2023-12-08 20:31 Update your jail file so the log path is this: ​ logpath = /var/log/proxy-host-*[!22]_access.log /var/log/proxy-host-*[!22]_error.log /var/log/default-host_*.log What this is telling fail2ban is, look for all files, but the \[!22\] is an exclusion. You can verify it excludes it after restarting fail2ban and checking fail2ban logs to see what it loaded. ---------------------------------------------------------------------- 11pts · 2023-12-08 20:47 Oh awesome this did the trick !! Thank you🙏 i should probably also mess around with that link you shared to see if i can actually make it work with Plex long term