Will running both fail2ban and ufw cause problems? I noticed that fail2ban modifies iptables rules, but ufw already has a ton of iptables rules defined... so I'm not sure if fail2ban will mess these up.
You can use ufw and fail2b together, but as indicated earlier, the order of (ufw) rules is what is important.
Out of the box, fail2ban uses iptables and inserts rules first in the INPUT chain. This will not do any harm or conflict with ufw.
If you wish to fully integrate fail2ban to use ufw (rather then iptables). You will need to edit a number of files including
jail.conf is where you define your services , including what port they are listening on (think changing ssh to a non-default port) and what action to take.
Using ssh as an example, note the definition of a non-default port as well =)
You then configure fail2ban to use ufw in (one .conf file for each service)
The syntax is
Note: You configure fail2ban to use ufw and to insert new rules FIRST using the "insert 1" syntax. The delete will find the rule regardless of order.
There is a nice blog post that goes into more detail here
I have been using fail2ban and ufw for years on couple of different computers, and never had any problems. To setup fail2ban:
Now edit the file as you wish, for example if you want to block unauthorized ssh find the lines:
if "enabled" is set to "false", change it to "true" as noted here. After you set the rules you need to restart the fail2ban process:
If you've opened the port 22 on your ufw firewall fail2ban will ban the clients that try to connect more than 6 times without success, it will not break your firewall.
Installed fail2ban today and found already an existing ufw.conf file in /etc/fail2ban/action.d/
The action code looks slightly different, more general:
I think you can use that and specify ufw in the default settings of you jail.local with
Having said that, I just installed it and have to wait for some results.