tomMoulard / fail2ban

Traefik plugin on fail2ban middleware
MIT License
204 stars 12 forks source link

Plugin not blocking the IP if 401 status code #142

Open Chris-luiz-16 opened 1 month ago

Chris-luiz-16 commented 1 month ago

I have a frontend docker container with labels written as follows. I'm expecting the plugin to block the Ip if there is any 401 code is detected in traefik json logs. Unfortunately the fail2ban plugin is not blocking the IP. Is there anything wrong in my traefik labels configuration

  labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.http.routers.rvm-accept-angularweb.rule=Host(`example.com`) || Host(`www.example.com`)"
        - "traefik.http.routers.rvm-accept-angularweb.entrypoints=websecure"
        - "traefik.http.routers.rvm-accept-angularweb.tls=true"
        - "traefik.http.services.rvm-accept-angularweb.loadbalancer.sticky=true"
        - "traefik.http.services.rvm-accept-angularweb.loadbalancer.server.port=443"
        - "traefik.http.services.rvm-accept-angularweb.loadbalancer.server.scheme=https"
        - "traefik.http.services.rvm-accept-angularweb.loadbalancer.sticky.cookie.httponly=true"
        - "traefik.http.routers.fail2ban-local.rule=Host(`example.com`) || Host(`www.example.com`)"
        - "traefik.http.routers.fail2ban-local.middlewares=fail2ban-local"
        - "traefik.http.middlewares.fail2ban-local.plugin.fail2ban-local.rules.enabled=true"
        - "traefik.http.middlewares.fail2ban-local.plugin.fail2ban-local.rules.bantime=10m"
        - "traefik.http.middlewares.fail2ban-local.plugin.fail2ban-local.rules.findtime=3m"
        - "traefik.http.middlewares.fail2ban-local.plugin.fail2ban-local.rules.maxretry=2"
        - "traefik.http.middlewares.fail2ban-local.plugin.fail2ban-local.rules.statuscode=401"
tomMoulard commented 1 month ago

Hello @Chris-luiz-16,

Thanks for your interest in this Traefik plugin !

I've released https://github.com/tomMoulard/fail2ban/releases/tag/v0.8.2 with an intensive logging approach. Can you try again your issue with the latest version and tell me if it's still relevant ?

Thanks !