I just installed fail2ban and the apf firewall. Those 2 seems to be not working together. Fail2ban have added some iptable rules but they are not working.

When I issue /etc/init.d/iptables status it says:

bash: /etc/init.d/iptables: No such file or directory...

How can I make it work with apf? I have Ubuntu 11.04 in a VPS!

  • sudo iptables -vnL instead of your status command. – jippie Apr 25 '12 at 9:14
  • @jippie That command works but fail2ban is not! – THpubs Apr 25 '12 at 9:37
up vote 4 down vote accepted

By default fail2ban is configured to work with iptables; this generates a configuration conflict with APF because fail2ban adds a chain to iptables and when you reload APF it wipes that fail2ban chain each time.

Fortunately you can configure fail2ban to have many different actions, this allows it to be able to work with iptables, shorewall, etc.

To make APF and fail2ban work together we just need to add an apf action to fail2ban: I created the /etc/fail2ban/action.d/apf.conf based on the shorewall.conf and we just need to edit actionban and actionunban to this:

actionban = apf --deny <ip>
actionunban = apf --remove <ip>

Then we have to configure fail2ban to use apf by editing the /etc/fail2ban/jail.conf file.

The line we are looking for is:

banaction = apf

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.