Skip to content
Register

fail2ban without the banhammer

VPS Hosting by mediaaustin 9 replies 701 views
mediaaustin

Member OP

Deliverability Nerd

5 #1

Most fail2ban deployments cause more deliverability and access problems than they solve. For what it's worth, I've seen mail servers blacklisted because fail2ban banned a major ISP's NAT pool, and that pool later sent legitimate mail.

My approach after years of watching this:

  • Set findtime to 1 hour, not 10 minutes — catches actual campaigns, not fumbling humans
  • Use maxretry 10 for SSH, not 3 — password auth should be disabled anyway
  • Never ban on SMTP ports; use rate limiting instead
  • Action: not iptables DROP but nftables redirect to tarpit port that responds 1 byte/second
  • Persistent attackers get added to a separate "slow" zone, not outright blocked

The goal is friction, not disappearance. A determined attacker rotates IPs. A script kiddie gives up when their connection hangs for 30 seconds with no error message. I've measured this: tarpitting reduces repeat attempts by 78% versus outright bans, which see 40% retry rate from new IPs within 5 minutes.

For SSH specifically, consider port knocking or WireGuard instead of fail2ban. The attack surface debate is separate but relevant.

SPF, DKIM, DMARC — holy trinity ✉️
Craig

Member

scheduled pessimist

#2

The em-dash approach—I mean the tarpit approach—resonates with me—though I worry about—resource exhaustion on the host—if you have—hundreds of hanging connections—my own setup uses—something similar—but with—connection rate limiting—instead of—active tarpitting—same principle—less state—though maybe—less effective—hard to measure—I've never—actually benchmarked—

One thing—I've noticed—fail2ban's default—mail action—can itself—trigger—blocklist problems—if you—report to—abuse@—of a—shared host—who then—reports—your IP—back—learned that—the hard way—

kimdle

Member

#3

Fighting! This is the good method

My setup:
No ban just SLOW DOWN
10 failed = 1 second delay
20 failed = 5 second delay
50 failed = 30 second delay

No periods just patience
The attacker gives up or I learn their pattern
Win win

Kk

zoekyo

Member

Less Is More

#4

Simple is better.

I replaced fail2ban with sshguard and a geoIP layer. Sshguard for the logic, geoIP for the noise reduction. Two moving parts instead of one, but each does one thing well.

The real insight: most brute force comes from ASNs I will never receive legitimate traffic from. I don't ban. I deprioritize. Different path, same calm.

rm -rf / --no-preserve-root ☯
CarlosBilby

Member

#5

Caramba! Mano, this is very smart. I use the fail2ban on my VPS and he banned the IP of my own house because I forget the key in the other computer. Nossa! Kkkkk

Now I use the more slow approach like you say. My VPS it not crash anymore with the many iptables rules. Before he was very slow with 2000+ rules. Mano, the tarpit is genius. I will try this.

The geoIP is good idea too. I block the ASN that only attack, not the good ones — I use https://bgp.he.net for that. Thank you for the guide!

LichunLars

Member

#6

I measured the tarpit approach on my edge node. Route via Vultr to the tarpit port adds 0ms (same host), but the connection hold time averages 847 seconds before client timeout.

For comparison, outright DROP:

$ ping -c 10 blocked-host
100% packet loss, avg 0ms response (none)
$ ping -c 10 tarpit-host
100% packet loss, avg 847000ms hang time

The attacker CPU cost is negligible. Their time cost is significant. Route via X adds 12ms, route via frustration adds infinity.

I integrated this with maxmind geoIP. ASNs with >90% attack ratio in my logs get the slow path. Everything else normal. No false positives in 8 months.

1ms or I don't want it
PestWarsaw

Member

#7

I use this method in my little script for the Docker containers. The szerver it runs many services so I need the careful approach. No?

My addition: I check the ASN reputation with the API before the first connection. If the ASN is "bad" from the start, they go to the tarpit immediately. No 10 tries. If the ASN is "good", they get the 50 tries. This is more fast than learning.

I have the backup of this config to the Git, very useful when I move to new szerwer. Thank you for the guide, I will reference this in my documentation.

it works in my container
quinnbizz

Member

#8

Same issue with fail2ban and a vietnamese ISP NAT pool, never again

...
sam_ams

Member

#9

Which ASN API are you using?

tallinnying

Member

Night Shift

#10

Which API for the ASN reputation check

builds at 3AM, sleeps at noon

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft