Debian 12 bookworm and nftables won't block

[jameskimmel]

Hi guys

I am fairly new to fail2ban but unfortunately was unable to setup some rules for a jellyfin host on debian 12.
The IP is banned, but I am still able to connect to the page. I suspect the switch from iptables to nftables to be the problem.

sudo nano /etc/fail2ban/jail.d/defaults-debian.conf
[sshd]
backend=systemd
enabled = true

[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]

Setting the backend was needed to even get fail2ban to start. Setting the banaction is how I think the switch to nftables is done?

sudo fail2ban-client status jellyfin
Status for the jail: jellyfin
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   10.0.51.3

But that banned IP is still able to connect. Any ideas? Thanks!

[sebres]

Basically there may be too many reasons to say something without details: jail config (fail2ban-client -d | grep jellyfin), output of nft chains and rules, etc.

Also note the FAQ in the wiki (answer to 2nd question)...

[sebres]

Regarding defaults - basically this is a matter of maintainers for Debian distribution.
Also jail.d/defaults-debian.conf is not a part of this repository - it is invention of them and part of salsa.debian.org/.../packages/fail2ban.
And I don't really like it: neither I believe the idea to enable jails by default is good, nor I think this is appropriate place for that, especially because the config for jail(s) belongs either to jail.local (preferred single file configuration) or to jail.d/<jail>.conf. But also (if we talking about backend = systemd for some jails) because we already have distribution-related includes, like this:

fail2ban/config/jail.conf

Line 36 in f8f8c04

before = paths-debian.conf

Anyway this configuration is pretty simple and everyone can do that by himself.
You can discuss it with @fail2ban/maintainers (e. g. with @sylvestre).
Or if you'd like, you can add a new wiki page or extend some existing like wiki :: Proper fail2ban configuration...

However then it should rather look like this (it belongs to jail.local and default section first):

# sudo nano /etc/fail2ban/jail.local

[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
backend=systemd
enabled = true

[sylvestre]

happy to make the change in Debian

[sylvestre]

Done:
https://salsa.debian.org/python-team/packages/fail2ban/-/commit/bc37c9413716b0f238bb154f00094a27a0670284

I will upload it in the next few days

[sebres]

Hmm... I'm unsure this default section would affect any jail excepting sshd specified here...
IIRC jail.d/*.conf are intended to load single jail (at least if it were jail.d/sshd.conf, unsure about different names) and then must affect only defaults related to that single jail.
But also if it accidentally works (so affects every jail no matter where it is specified), it looks ambiguous to me, but still worse we can't guarantee the load mechanisms would not change later and it would only affect jails specified in that file.
In my opinion better and more consistent would be to have /etc/fail2ban/defaults-debian.conf and something like that in jail.conf:

  [INCLUDES]
  before = paths-debian.conf
+ after = defaults-debian.conf

[jameskimmel]

Well, you guys are way more competent than me to decide how to solve this in the most elegant way :)
Do you wanna discuss it further or should I close this discussion?

[JuergenKosel]

I have set in /etc/fail2ban/jail.local 👍

[DEFAULT]
banaction = nftables-multiport

And this solved the problem for me.
Taken from https://blog.cyberfront.org/index.php/2021/10/27/debian-fail2ban/