Fail2Ban Banning but not Blocking #2971

New Issue

MrUnknownDE · 2026-04-06T04:21:02+02:00

MrUnknownDE commented

2026-04-06 04:21:02 +02:00

Originally created by @abcde57219 on 4/22/2020

Thank you for providing the information on this repository. I set up Fail2Ban shortly after installing BitwardenRS a month or two ago. At that time, Fail2Ban seemed to be working. I checked it this weekend, and although my IP is being banned in the logs, I can still successfully log into BitwardenRS. I have also setup notifications and receive an e-mail that I have been banned when I try to log in 5 times.

I am running BitwardenRS using the bitwardenrs/server:latest docker image and Fail2Ban using crazymax/fail2ban:latest docker image. I am using a Synology NAS with a reverse proxy to access BitwardenRS. A couple of approaches I have tried to fix the issue include:

Adding the NAS ports and the reverse proxy port in addition to the BitwardenRS container's ports.
Adding /action.d/iptables-allports.local to try to kill any existing connections as I read this could be an issue. I only receive error messages in the log when I try this.
Adding chain=FORWARD to the /jail.d/bitwarden.local file. However, I did not think this necessary because I am using a reverse proxy.
I have made sure the timezone is the same in all areas.
I tried on my cellphone using the cellphone network IP.

Please let me know if you think there is anything else I can try.

Here is from my logs:

2020-04-19 01:17:59,883 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:17:59
2020-04-19 01:18:01,059 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:01
2020-04-19 01:18:01,913 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:01
2020-04-19 01:18:02,694 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:02
2020-04-19 01:18:03,488 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:03
2020-04-19 01:18:03,714 fail2ban.actions  [1]: NOTICE  [bitwarden] Ban myip
2020-04-19 01:18:04,326 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:04
2020-04-19 01:18:05,230 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:05
2020-04-19 01:18:06,091 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:06
2020-04-19 01:18:07,562 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:07
2020-04-19 01:18:09,345 fail2ban.filter   [1]: INFO    [bitwarden] Found myip - 2020-04-19 01:18:09
2020-04-19 01:18:10,933 fail2ban.actions [1]: NOTICE  [bitwarden] myip already banned

Here is from my /jail.d/bitwarden.local:

[bitwarden]
enabled = true
port = 80,3012
filter = bitwarden
action = iptables-allports[name=Bitwarden]
         sendmail-whois[name=Bitwarden, dest=myemail@email.com]
logpath = /bitwarden/bitwarden.log
maxretry = 5
bantime = 14400
findtime = 14400

Here is from my /filter.d/bitwarden.local:

[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
ignoreregex =

Here is from my /action.d/iptables-common.local:

[Init]
blocktype = DROP
[Init?family=inet6]
blocktype = DROP

Here is from my docker-compose.yml:

version: '3'
services:
  fail2ban:
    container_name: fail2ban
    restart: always
    image: crazymax/fail2ban:latest
    environment: 
    - TZ=Etc/UTC
    - F2B_DB_PURGE_AGE=1d
    - F2B_LOG_TARGET=/data/fail2ban.log
    - F2B_LOG_LEVEL=INFO
    - F2B_IPTABLES_CHAIN=INPUT
    - SSMTP_HOST=smtp.email.com
    - SSMTP_PORT=port
    - SSMTP_HOSTNAME=email
    - SSMTP_USER=myemail@email.com
    - SSMTP_PASSWORD=mypassword
    - SSMTP_TLS=YES
    - SSMTP_STARTTLS=Yes

    volumes:
    - /volume1/docker/fail2ban:/data
    - /volume1/docker/bitwarden:/bitwarden:ro

    network_mode: "bridge"

    privileged: true
    cap_add:
        - NET_ADMIN
        - NET_RAW

*Originally created by @abcde57219 on 4/22/2020* Thank you for providing the information on this repository. I set up Fail2Ban shortly after installing BitwardenRS a month or two ago. At that time, Fail2Ban seemed to be working. I checked it this weekend, and although my IP is being banned in the logs, I can still successfully log into BitwardenRS. I have also setup notifications and receive an e-mail that I have been banned when I try to log in 5 times. I am running BitwardenRS using the bitwardenrs/server:latest docker image and Fail2Ban using crazymax/fail2ban:latest docker image. I am using a Synology NAS with a reverse proxy to access BitwardenRS. A couple of approaches I have tried to fix the issue include: - Adding the NAS ports and the reverse proxy port in addition to the BitwardenRS container's ports. - Adding /action.d/iptables-allports.local to try to kill any existing connections as I read this could be an issue. I only receive error messages in the log when I try this. - Adding chain=FORWARD to the /jail.d/bitwarden.local file. However, I did not think this necessary because I am using a reverse proxy. - I have made sure the timezone is the same in all areas. - I tried on my cellphone using the cellphone network IP. Please let me know if you think there is anything else I can try. **Here is from my logs:** ``` 2020-04-19 01:17:59,883 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:17:59 2020-04-19 01:18:01,059 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:01 2020-04-19 01:18:01,913 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:01 2020-04-19 01:18:02,694 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:02 2020-04-19 01:18:03,488 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:03 2020-04-19 01:18:03,714 fail2ban.actions [1]: NOTICE [bitwarden] Ban myip 2020-04-19 01:18:04,326 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:04 2020-04-19 01:18:05,230 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:05 2020-04-19 01:18:06,091 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:06 2020-04-19 01:18:07,562 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:07 2020-04-19 01:18:09,345 fail2ban.filter [1]: INFO [bitwarden] Found myip - 2020-04-19 01:18:09 2020-04-19 01:18:10,933 fail2ban.actions [1]: NOTICE [bitwarden] myip already banned ``` **Here is from my /jail.d/bitwarden.local:** ``` [bitwarden] enabled = true port = 80,3012 filter = bitwarden action = iptables-allports[name=Bitwarden] sendmail-whois[name=Bitwarden, dest=myemail@email.com] logpath = /bitwarden/bitwarden.log maxretry = 5 bantime = 14400 findtime = 14400 ``` **Here is from my /filter.d/bitwarden.local:** ``` [INCLUDES] before = common.conf [Definition] failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$ ignoreregex = ``` **Here is from my /action.d/iptables-common.local:** ``` [Init] blocktype = DROP [Init?family=inet6] blocktype = DROP ``` **Here is from my docker-compose.yml:** ``` version: '3' services: fail2ban: container_name: fail2ban restart: always image: crazymax/fail2ban:latest environment: - TZ=Etc/UTC - F2B_DB_PURGE_AGE=1d - F2B_LOG_TARGET=/data/fail2ban.log - F2B_LOG_LEVEL=INFO - F2B_IPTABLES_CHAIN=INPUT - SSMTP_HOST=smtp.email.com - SSMTP_PORT=port - SSMTP_HOSTNAME=email - SSMTP_USER=myemail@email.com - SSMTP_PASSWORD=mypassword - SSMTP_TLS=YES - SSMTP_STARTTLS=Yes volumes: - /volume1/docker/fail2ban:/data - /volume1/docker/bitwarden:/bitwarden:ro network_mode: "bridge" privileged: true cap_add: - NET_ADMIN - NET_RAW ```

MrUnknownDE closed this issue

2026-04-06 04:21:02 +02:00

Sign in to join this conversation.

No Label better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum better for forum

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#2971