Default F2B settings on Deb13

Virtualmin
1
SYSTEM INFORMATION
OS type and version Debian Linux 13
Webmin version 2.653
Usermin version 2.552
Virtualmin version 8.1.0 GPL
Theme version 26.50.4
Apache version 2.4.68
Package updates All installed packages are up to date

Im guessing this one is for you Ilia

We have just moved our 2 NS servers over to Deb 13 and I have noticed that there now appears to be a new virtualmin config file that is created at installation time for F2B

image
image652×231 15.5 KB

It now seems that the default action is rich-rules which fills the firewall with this

image
image1440×798 217 KB

The old way way was like this

image
image1388×851 77.7 KB

So where we had all ips grouped into the the jail they were put in it now appears we have 1 line per ip address. The interesting is I have noticed is the same IP address is appearing in multiple lines which is telling me the IP address is NOT being banned correctly otherwise this would not be possible

eg

image
image1495×657 199 KB

Also the same IP address is in multiple jails

image
image1553×656 40.3 KB

This is leading me to believe something is broken and the rules are not working. For example once an IP is listed in the recidive jail which bans them for a week its should not be possible then reappear in the postfix jail some hours later.

I’m all ears

Thanks
Michael

2

Hello,

Thanks for reaching out!

Did you install Debian 13 clean or did you migrate from a previous Debian version using distro upgrade?

Also, what is the output of the following command:

dpkg -l | grep firewalld
3

The change is probably due to Debian 13 using firewalld rich rules with Fail2Ban instead of the older iptables-style action. Rich rules are created individually, so seeing one entry per IP is expected and makes the firewall list look much larger.

An IP appearing in multiple jails does not always mean the ban is broken, since each jail manages its own rules. However, if recidive is supposed to block an address for a week, it is worth checking whether the action is being applied correctly.

I would check:



fail2ban-client status recidive
fail2ban-client get recidive action

and watch the logs while a ban happens:



journalctl -u fail2ban -f

If the same IP is repeatedly added by different jails after recidive, then there may be an issue with the action configuration. Otherwise, the multiple rich-rule entries may just be the new way Debian/firewalld displays bans.

4

Hi Ilia

Always a clean install,

root@ns2:~# dpkg -l | grep firewalld
ii firewalld 2.3.1-1+deb13u1 all dynamically managed firewall with support for network zones
ii python3-firewall 2.3.1-1+deb13u1 all Python3 bindings for firewalld

Thanks
Michael

5

Ah, I see now… Try making virtualmin-firewalld.conf fail2ban config file look as:

[DEFAULT]
port = 1-65535
banaction = firewallcmd-rich-rules
banaction_allports = firewallcmd-rich-rules

Restart fail2ban and let me know if the original issue is solved?

6

Hi Ilia

Yes that has now got it working.

Don’t forget to update the install script so I don’t bug you again :laughing:

Thanks
Michael

7

Thanks, ran into the same problem on Debian 12. When checking the config I wonder why there are rich rules instead of ipsets. Will ask in another topic

8

so this is Debian only file. Rocky I don’t see the file, but found this one

image
image774×289 20.9 KB

Do I update to the same?

9

As described in the comment linked below, it’s better to configure Fail2ban to use IP sets: