1
sudo apt install fail2ban ipset

1
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
2
sudo vim /etc/fail2ban/jail.local

1
[INCLUDES]
2
before = paths-debian.conf
3

4
[DEFAULT]
5
# 1. SEGURIDAD BÁSICA
6
ignoreip = 127.0.0.1/8 ::1
7
enabled = false
8
findtime  = 1d
9
maxretry = 7
10
bantime  = 1d
11

12
# 2. PARÁMETROS DE FUNCIONAMIENTO
13
backend = auto
14
usedns = warn
15
logencoding = auto
16
mode = normal
17
filter = %(__name__)s[mode=%(mode)s]
18

19
# 3. ACCIÓN DE BANEO (Solo Firewall, sin rastro de email)
20
protocol = tcp
21
chain = <known/chain>
22
port = 0:65535
23

24
# Usamos ipset para máximo rendimiento
25
banaction = iptables-ipset-proto6
26
banaction_allports = iptables-allports
27

28
# Definimos que la acción sea estrictamente banear
29
action = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
30

31
# --- CÁRCELES (JAILS) ---
32

33
[sshd]
34
enabled = true
35
port    = ssh
36
backend = systemd
37
maxretry = 5
38

39
[recidive]
40
enabled = true
41
logpath  = /var/log/fail2ban.log
42
banaction = %(banaction_allports)s
43
bantime  = 1w
44
findtime = 3d
45
maxretry = 10

1
sudo systemctl restart fail2ban
2
sudo systemctl status fail2ban

1
sudo fail2ban-client status sshd

1
sudo fail2ban-client status sshd
2

3
sudo fail2ban-client set sshd unbanip _IP_