I just installed fail2ban and the apf firewall. Those 2 seems to be not working together. Fail2ban have added some iptable rules but they are not working.

When I issue /etc/init.d/iptables status it says:

bash: /etc/init.d/iptables: No such file or directory...

How can I make it work with apf? I have Ubuntu 11.04 in a VPS!

  • sudo iptables -vnL instead of your status command.
    – jippie
    Apr 25, 2012 at 9:14
  • @jippie That command works but fail2ban is not!
    – THpubs
    Apr 25, 2012 at 9:37

1 Answer 1


By default fail2ban is configured to work with iptables; this generates a configuration conflict with APF because fail2ban adds a chain to iptables and when you reload APF it wipes that fail2ban chain each time.

Fortunately you can configure fail2ban to have many different actions, this allows it to be able to work with iptables, shorewall, etc.

To make APF and fail2ban work together we just need to add an apf action to fail2ban: I created the /etc/fail2ban/action.d/apf.conf based on the shorewall.conf and we just need to edit actionban and actionunban to this:

actionban = apf --deny <ip>
actionunban = apf --remove <ip>

Then we have to configure fail2ban to use apf by editing the /etc/fail2ban/jail.conf file.

The line we are looking for is:

banaction = apf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .