already banned

  • Resolved sidro

    (@sidro)


    5 years, 9 months ago

    hello,

    i’ve got lots of messages in wordpress-hard jail that say’s 

    2019-06-16 20:13:26,099 fail2ban.actions[1741]: INFO    [wordpress-hard] 5.188.62.5 already banned
2019-06-16 20:13:27,100 fail2ban.actions[1741]: INFO    [wordpress-hard] 5.188.62.5 already banned
2019-06-16 20:51:10,901 fail2ban.actions[1741]: INFO    [wordpress-hard] 5.188.62.5 already banned
2019-06-16 20:51:12,902 fail2ban.actions[1741]: INFO    [wordpress-hard] 5.188.62.5 already banned
2019-06-16 21:09:24,740 fail2ban.actions[1741]: WARNING [ssh] Ban 104.236.94.49
2019-06-16 21:29:16,954 fail2ban.actions[1741]: INFO    [wordpress-hard] 5.188.62.5 already banned
2019-06-16 21:29:17,956 fail2ban.actions[1741]: INFO    [wordpress-hard] 5.188.62.5 already banned

    any idea how to fix this one, ip is already unreachable in ip route “unreachable 5.188.62.5 “, no idea why it can still connect to my server

    5.188.62.5 - - [16/Jun/2019:20:51:10 +0800] "POST /wp-login.php HTTP/1.1" 200 1429 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
5.188.62.5 - - [16/Jun/2019:20:51:11 +0800] "POST /wp-login.php HTTP/1.1" 200 1669 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"

    thanks

    • This topic was modified 5 years, 9 months ago by sidro.
    • This topic was modified 5 years, 9 months ago by sidro.
Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Author invisnet

    (@invisnet)

    You need to check how you’ve configured fail2ban to talk to the firewall; fail2ban thinks it’s banned the IP but the firewall isn’t blocking it.

    Thread Starter sidro

    (@sidro)

    i used ip route for blocking instead of iptables, ip address is already blocked by ip route but somehow are able to connect on my wordpress site, other jails are working fine without the already banned messages

    :~$ ip route list | grep -i 5.188.62
unreachable 5.188.62.5 
    :~$ ping 5.188.62.5
connect: No route to host
    • This reply was modified 5 years, 8 months ago by sidro.
    Plugin Author invisnet

    (@invisnet)

    Did you resolve this? The only thing I can think of is that the firewall is creating a state that’s superseding the routing table.

    Thread Starter sidro

    (@sidro)

    i noticed that it only happened when the attack is persistent, ie in milliseconds apart, probably just timing issues 

    2019-07-07 18:43:58,646 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:00,649 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:01,650 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:02,652 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:04,654 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:06,657 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:07,659 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:09,661 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:10,663 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:11,665 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:14,668 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:17,672 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:19,675 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
2019-07-07 18:44:20,676 fail2ban.actions[1430]: INFO    [wordpress-hard] 47.92.254.178 already banned
    Plugin Author invisnet

    (@invisnet)

    FYI, I think I’ve worked out what’s going on; there’ll be a fix in 4.3.0.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘already banned’ is closed to new replies.