I have a trusty 14.04.3 LTS server with fail2ban running. I have been under attack from 43.229.53.71; the last octet can change. My auth.log files show entries like this:
Dec 11 15:02:51 M1 sshd[5138]: Failed password for root from 43.229.53.71 port 39734 ssh2
Dec 11 15:02:51 M1 sshd[5138]: pam_winbind(sshd:auth): getting password (0x00000388)
Dec 11 15:02:51 M1 sshd[5138]: pam_winbind(sshd:auth): pam_get_item returned a password
Dec 11 15:02:51 M1 sshd[5138]: pam_winbind(sshd:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_USER_UNKNOWN (10), NTSTATUS: NT_STATUS_NO_SUCH_USER, Error message was: No such user
Dec 11 15:02:53 M1 sshd[5138]: Failed password for root from 43.229.53.71 port 39734 ssh2
Dec 11 15:02:53 M1 sshd[5138]: Received disconnect from 43.229.53.71: 11: [preauth]
Dec 11 15:02:53 M1 sshd[5138]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.229.53.71 user=root
Here are my iptables rules:
root@M1:/etc# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 7736 packets, 6163K bytes)
num pkts bytes target prot opt in out source destination
1 0 0 fail2ban-mysqld-auth tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 3306
2 45 2838 fail2ban-apache-overflows tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
3 45 2838 fail2ban-apache-noscript tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
4 45 2838 fail2ban-apache-multiport tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
5 1581 100K fail2ban-ssh-ddos tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22
6 5080 5449K fail2ban-pam-generic tcp -- * * 0.0.0.0/0 0.0.0.0/0
7 1581 100K fail2ban-ssh tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22
8 0 0 REJECT tcp -- * * 43.225.53.71 0.0.0.0/0 tcp dpt:22 reject-with icmp-port-unreachable
9 0 0 REJECT tcp -- * * 43.225.0.0/16 0.0.0.0/0 tcp dpt:22 reject-with icmp-port-unreachable
10 0 0 DROP all -- * * 43.225.0.0/16 0.0.0.0/0
11 0 0 DROP all -- * * 43.225.0.0/16 0.0.0.0/0
12 0 0 DROP all -- * * 43.225.53.71 0.0.0.0/0
13 0 0 DROP all -- * * 43.225.53.71 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 5703 packets, 4217K bytes)
num pkts bytes target prot opt in out source destination
Chain fail2ban-apache-multiport (1 references)
num pkts bytes target prot opt in out source destination
1 45 2838 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-apache-noscript (1 references)
num pkts bytes target prot opt in out source destination
1 45 2838 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-apache-overflows (1 references)
num pkts bytes target prot opt in out source destination
1 45 2838 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-mysqld-auth (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-pam-generic (1 references)
num pkts bytes target prot opt in out source destination
1 5080 5449K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-ssh (1 references)
num pkts bytes target prot opt in out source destination
1 1581 100K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-ssh-ddos (1 references)
num pkts bytes target prot opt in out source destination
1 1581 100K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
When I enable SSH, they start attacking as shown in the logs. Why are the packets from this IP range not being dropped? I must be missing something simple, any ideas ?
