make manual ban effective immediately

[Kapsonfire]

I try to add rules for manual ban, so first i added a new jail in /etc/jail.local

[blocklist]
enabled  =  true
port     =  all
filter   =  none
logpath  =  /etc/fail2ban/empty.log
maxretry =  1
bantime  =  3600
action   =  %(action_)s

fail2ban-client status seems fine

|- Number of jail:      8
`- Jail list:           blocklist, proftpd, ssh-ddos, apache-overflows, ssh, dovecot, apache, sasl

So heres my filter:

[Definition]

failregex =



ignoreregex =

Here's the output:

server1:/etc/fail2ban/filter.d# fail2ban-client set blocklist banip "22.22.22.22"
22.22.22.22

Result in iptables seems empty:

Chain fail2ban-blocklist (0 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Any idea?

[yarikoptic]

have you seen #50 ?

[Kapsonfire]

yeah allready did it... no effect
i try to make a workaround now to write in the emptylog with regex
echo date +"%Y/%m/%d %H:%M:%S" "A-IP" >> empty.log
somehow it ends with blocking the ip 0.0.0.20
doesn't matter what IP i add in the Log

[Kapsonfire]

ok now correcting... it works after 1 minute... somehow...
but whats the failure about the 0.0.0.20 block=

[yarikoptic]

yes -- may be it is due to the backend you are using (which is ...?) or
necessity for a log file to be touched to trigger action as reported in
#45
?

On Wed, 16 May 2012, Kapsonfire wrote:

ok now correcting... it works after 1 minute... somehow...
but whats the failure about the 0.0.0.20 block=

---

Reply to this email directly or view it on GitHub:
#53 (comment)

Yaroslav O. Halchenko
Postdoctoral Fellow, Department of Psychological and Brain Sciences
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419
WWW: http://www.linkedin.com/in/yarik

[yarikoptic]

so ATM it requires the log file jail monitors to get modified to trigger an action... otherwise manual ban is working. I have retitled the issue and postponed it for milestone 0.9.0

[yarikoptic]

I think this one was addressed by 2d672d1