Fail2Ban or different DDOS protection?

[nsauter]

Hi!

Thanks for this awesone piece of code. I tried some of the features and i really liked the way warpgate works. But i have one question: Since the Idea is to have Warpgate exposed in the public network (internet) in im a security paranoid i would like to have something like fail2ban or other 'ddos and brute force' protection already included. What do you think about this? Are there any best practices for that?

Thanks Nico

[Eugeny]

Fail2ban should theoretically work fine since it acts on iptables level and can read any logs. You'd just need to design regexes to filter out the client IP from the Warpgate log.

WG also supports sending JSON logs to a socket (logs.send_to config option) so you could couple that with Vector for actual resilient parsing instead of regexes

[sandroshu]

I have added it like this to my fail2ban filters. It's not great, but works for now:

[Definition]

logtype = file
failregex = ^.*warpgate.*\{.*client_ip=<HOST>\}.*Target.*not authorized for.*$
            ^.*warpgate.*\{.*client_ip=<HOST>.*\}.*Selected user not found.*$

ignoreregex =