Add new comment

This is my /etc/hosts.deny contents as of today:

  
#
# hosts.deny    This file contains access rules which are used to
#               deny connections to network services that either use
#               the tcp_wrappers library or that have been
#               started through a tcp_wrappers-enabled xinetd.
#
#               The rules in this file can also be set up in
#               /etc/hosts.allow with a 'deny' option instead.
#
#               See 'man 5 hosts_options' and 'man 5 hosts_access'
#               for information on rule syntax.
#               See 'man tcpd' for information on tcp_wrappers
#
ALL: 5.10.115.6
ALL: 158.85.169.152
ALL: 113.28.44.14
ALL: 175.126.103.65
ALL: 106.187.96.51
ALL: 175.45.48.218
ALL: 190.85.89.30
ALL: 223.105.0.129
ALL: 41.254.9.240
ALL: 41.254.9.60
ALL: 37.211.66.180
ALL: 202.3.77.44
ALL: 104.217.216.174
ALL: 104.223.6.154
ALL: 104.223.72.169
ALL: 107.6.166.234
ALL: 122.226.102.202
ALL: 123.176.36.2
ALL: 173.254.236.10
ALL: 180.97.215.154
ALL: 180.97.215.49
ALL: 192.240.106.50
ALL: 198.2.197.153
ALL: 204.151.201.20
ALL: 222.171.107.116
ALL: 222.186.130.243
ALL: 222.186.21.113
ALL: 222.186.21.35
ALL: 222.186.21.52
ALL: 222.186.51.61
ALL: 222.186.58.81
ALL: 222.187.222.35
ALL: 23.253.62.189
ALL: 37.49.226.124
ALL: 42.114.146.128
ALL: 45.32.26.28
ALL: 58.187.135.69
ALL: 58.215.79.87
ALL: 58.218.204.163
ALL: 58.64.155.107
ALL: 61.160.247.11
ALL: 85.125.187.98
  

If you will check each of the IP address, there is no IP address from Philippines banned in my server. This shows that the script in this article works just fine. It was tested for several times before I publish this article.

Make sure you have "filter" enabled in your "jail.local". E.g. in /etc/fail2ban/jail.local:

  
[DEFAULT]
ignoreip = 127.0.0.1/8
maxretry = 3
bantime  = 900
banaction = geohostsdeny
[sshd-ddos]
enabled = true
  

I enabled the filter ssh-ddos. All bad traffic that will be detected by fail2ban and falls under ssh-ddos rules 3 times, fail2ban will ban these IP addresses (except Philippine IP address) for 15 minutes.