Why isn't Fail2ban regenerating its iptables chains?
At some point while running iptables -S
on an Ubuntu 18.04.2 LTS system with Fail2ban installed, I noticed that the following lines were missing:
-N f2b-sshd
-A f2b-sshd -j RETURN
What command should I run to regenerate the f2b-sshd chain and all the rules associated with it? I tried running fail2ban-client restart
, but this doesn't appear to have any effect.
Given a banaction
of iptables-multiport
in /etc/fail2ban/jail.conf
or /etc/fail2ban/jail.local
, it looks like Fail2ban will automatically regenerate the f2b-sshd chain when it bans an IP address—but no earlier. If you'd like to test this for yourself, try running the following command to manually ban an address (like this one from TEST-NET-1):
# fail2ban-client -vvv set sshd banip 192.0.2.0
This behavior appears to be new in Fail2ban v0.10, which now creates chains on demand the first time an IP address is banned by an iptables action.