iptables fail2ban 基礎

sudo apt-get install iptables-persistent

sudo service fail2ban stop

ベースファイアウォールを作る

iptables -F
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

sudo iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -m set --match-set BLACKLIST src -j DROP
sudo iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -m set --match-set BLACKLIST src -j DROP

sudo iptables -A INPUT -j DROP

確認
sudo iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -j DROP

ファイアウォールを保存して再起動で消えないようにする
sudo dpkg-reconfigure iptables-persistent

sudo service fail2ban start

sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-ssh
-A INPUT -p tcp -m multiport –dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack –ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp –dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 80 -j ACCEPT
-A INPUT -j DROP
-A fail2ban-ssh -j RETURN