Fail2Ban and Firewalld

There is the ability in Fail2ban to linearly or exponentially increase ban times for repeated offenders. I like this approach for people or (me) that might mistakenly hit the ban. In 10 minutes I can try again but repeated failures can then be an hour, a day then a week and then 6 weeks. You set the schedule like this from my /etc/fail2ban/jail.local Centos 7

I use 17 minutes as the initial ban time here because I report the offending IPs to abuseipdb.com and that site will only accept repeat reports after 15 minutes. Set ban time to whatever works for you.

Also, max bantime I set to 6 weeks. I find that works well because I set the dbpurge (fail2ban internal database purge) time to 59 days.

bantime = 17m
bantime.increment = true
bantime.factor = 1
bantime.multipliers = 1 10 84 588 4000
port = 0-65535
bantime.maxtime = 6w
2 Likes