Open FDF1337 opened 2 years ago
786534786
commented
2 years ago Exactly the same for me. Fail2ban registers it, but the block doesn't work.
Both with chain = DOCKER-USER and chain = INPUT.
Also the latest release 0.11.2-r4 makes no difference.
FDF1337
commented
2 years ago Hi 786534786
Few weeks ago i finally found the solution to solve the problem. Take a look on the following website: https://docs.docker.com/engine/security/rootless/
... docker run -p does not propagate source IP addresses
This is because Docker with rootless mode uses RootlessKit’s builtin port driver by default.
The source IP addresses can be propagated by creating ~/.config/systemd/user/docker.service.d/override.conf with the following content:
[Service] Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns"
And then restart the daemon: systemctl --user daemon-reload systemctl --user restart docker
This solved my problem :)
Greetings
786534786
commented
2 years ago Thank you FDF1337 for your detailed reply.
Regardless of your solution.
It is now also clear to me that if docker is not running with rootless mode, it also makes no difference. While this was previously the case.
Timereacer
commented
2 years ago Hello @786534786, I have the same issue. I am using the official Docker package from the Synology package center. My Vaultwarden (vaultwarden/server:latest) is generating the logs, fail2ban is noticing the login attempts and baning the real IP. But it seems that the IP gets not passed on to the iptables or the Synology firewall.
Have you been able to fix the issue?
786534786
commented
2 years ago No unfortunately not yet.
evrydayzawrkday
commented
2 years ago Following, have a very similar issue I opened today within the Vaultwarden github.
Gugu04
commented
1 year ago I have the same problem but I don't understand why with SSH it works correctly. If I add some other service it doesn't work for me.
Monoboy4ik
commented
1 month ago Hello @786534786, I have the same issue. I am using the official Docker package from the Synology package center. My Vaultwarden (vaultwarden/server:latest) is generating the logs, fail2ban is noticing the login attempts and baning the real IP. But it seems that the IP gets not passed on to the iptables or the Synology firewall.
Have you been able to fix the issue?
have too on synology
Behaviour
Steps to reproduce this issue
Expected behaviour
Actual behaviour
Configuration
docker --version):Docker version 20.10.12, build e91ed57docker-compose --version) :docker-compose version 1.29.2, build unknownRaspian/armv7luname -a):Linux raspberrypi 5.10.63-v7l+ #1496 SMP Wed Dec 1 15:58:56 GMT 2021 armv7l GNU/Linuxdocker-compose.yml,.env, ...docker-compose.yml
Docker info
Logs
fail2ban.log
docker logs fail2ban
I'm not sure if i choosed the correct setting for F2B_IPTABLES_CHAIN (INPUT) as i don't understand it well. But i also tried with the value "DOCKER-USER" but unfortunately without success. Furthermore one really important thing is to mention, that docker is running in rootless mode.
As till now, i was not able to install the plugin https://github.com/mastercactapus/caddy-proxyprotocol i still get the private ip address from the docker host itself when trying to login with wrong credentials which will cause a DOS at this time. But at the end, i would like to ban the right ip address which i'll try to implement when i could fixed this issue.
Thank you for your support!