Description of problem: I run asterisk 1.8.20.0 on a CentOS 6.5 system with the EPEL repository. After upgrading to fail2ban-0.8.11-2.el6, I enabled the following jail in /etc/fail2ban/jail.local as suggested by comments in the /etc/fail2ban/jail.conf file: # cat jail.local [asterisk] enabled = true After restarting fail2ban, I see the chain "fail2ban-asterisk-udp" created, but not the expected "fail2ban-asterisk-tcp" chain. There is the expected rule added in the INPUT chain to direct UDP packets on ports 5060 and 5061 to the newly created "fail2ban-asterisk-udp" chain, but again, no corresponding INPUT chain rule to redirect TCP packets on ports 5060 and 5061 to the missing "fail2ban-asterisk-tcp" chain. Version-Release number of selected component (if applicable): fail2ban-0.8.11-2.el6 How reproducible: Always Steps to Reproduce: 1. Add [asterisk] jail to /etc/fail2ban/jail.local 2. Restart fail2ban 3. Observe via iptables -L that no chain was created to catch TCP connections Actual results: No filtering of TCP connections to ports 5060,5061 to fail2ban chains Expected results: Either the INPUT rule would pass both TCP *and* UDP traffic on ports 5060,5061 to one fail2ban created chain, or separate TCP and UDP chains and rules would be created. Additional info: iptables -L output: # iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-asterisk-udp udp -- anywhere anywhere multiport dports sip,sip-tls fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:sip ACCEPT udp -- anywhere anywhere state NEW udp dpt:sip REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain fail2ban-SSH (1 references) target prot opt source destination RETURN all -- anywhere anywhere Chain fail2ban-asterisk-udp (1 references) target prot opt source destination RETURN all -- anywhere anywhere
fail2ban-0.8.13-1.el6 has been submitted as an update for Fedora EPEL 6. https://admin.fedoraproject.org/updates/fail2ban-0.8.13-1.el6
Package fail2ban-0.8.13-1.el6: * should fix your issue, * was pushed to the Fedora EPEL 6 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=epel-testing fail2ban-0.8.13-1.el6' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1985/fail2ban-0.8.13-1.el6 then log in and leave karma (feedback).
After upgrading to fail2ban-0.8.13-1.el6.noarch from the epel-testing repo, I still see the same behavior as described in the original report. If I just define [asterisk] in jail.local, only the "fail2ban-asterisk-udp" chain is created, and not the additional expected "fail2ban-asterisk-tcp" chain.
Package fail2ban-0.8.13-2.el6: * should fix your issue, * was pushed to the Fedora EPEL 6 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=epel-testing fail2ban-0.8.13-2.el6' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1985/fail2ban-0.8.13-2.el6 then log in and leave karma (feedback).
Upstream issue filed at: https://github.com/fail2ban/fail2ban/issues/798
See https://copr.fedoraproject.org/coprs/orion/fail2ban-el6/ if you'd like to test out 0.9.1.