#1053414 fail2ban: Creates the chain in iptables but does not add the banned IPs.

Package:
fail2ban
Source:
fail2ban
Submitter:
Bruno Meirelles
Date:
2024-09-01 12:45:01 UTC
Severity:
normal
#1053414#5
Date:
2023-10-03 17:50:32 UTC
From:
To:
Dear Maintainer,

He creates the chain in iptables, but doesn't add the banned IPs. I
switched to using nftables, and it's working correctly."
#1053414#10
Date:
2024-08-31 00:01:35 UTC
From:
To:
Hey.

I'd say this one is also at least grave (it breaks the sensible use of
fail2ban itself) or rather even critical (as fail2ban is used for
security purposes).

The package recommends either iptables/nftalbes (which I guess is in
principle good, because people should have the choice... and it's even
thinkable to use fail2ban without either of those, though I guess only
few would do so in practise).

Nevertheless, there was at some point a silent change from using:
   banaction = iptables-multiport
   banaction_allports = iptables-allports
(which is still set as such in the "main" jail.conf)
to that being overridden in jail.d/defaults-debian.conf:
   banaction = nftables
   banaction_allports = nftables[type=allports]


AFAICs, there is no NEWS.Debian entry or anything where people could
have realistically learned about that change (which may however easily
break their setup):
a) if ntfables is not installed at all
b) if they still use iptables for configuring their netfilter and
    want/need the f2b rules to be added at some special place in
    the order of rules

This is worsened by fail2ban.service apparently not failing if the
nftables is missing, so people have no real chance (except by manually
looking) that fail2ban is actually in a broken state.


Cheers,
Chris.
#1053414#17
Date:
2024-09-01 06:36:54 UTC
From:
To:
Hello,

Not sure I agree with the change of severity. If you are using such
tools, you should know
which firewall you have installed.

What do you think we should do ? for the install of nftables?

Thanks

S

Le 31/08/2024 à 02:01, Christoph Anton Mitterer a écrit :
#1053414#24
Date:
2024-09-01 12:43:33 UTC
From:
To:
Hey.

Yes, one can expect, that people know which firewall they use, but not that fail2ban rather silently switches from previously iptables to nftables.
Especially also as fail2ban seems to fail silently (I'm mean it's in the logs, but one cannot really expect people to read them without reason).

What I'd recommend is adding a NEWS.Debian entry (for the next version, not the past one where the change was made) and probably a release notes entry, probably also detailing how they could switch back.

I'd definitively not depend on nftables, ... if people still set their stuff up via iptables, that might break even more things.


Cheers,
Chris.