fail2ban log and unban #264
Assignees
adam (Adam Wojcieszonek)
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: adam/znc#264
Reference in new issue
Block a user
I'm running a znc instance as a semi-official bouncer for the engineers and developers at work, where we use an internal IRC server as our main communication method. We're running znc behind a F5 LTM hardware load balancer, and most of our users are using irssi as their client.
I'm seeing issues where all of a sudden nobody can connect to znc (current connections are OK), everyone's client gets the "ERROR :Closing link [Please try again later - reconnecting too fast]" message. My guess is that this is because of the load balancer configuration, znc sees all clients as having the same IP address.
While a reconfiguration of the load balancer is required to fix this, I'd really like 2 additions to the fail2ban module:
- an optional log file of every denied connection
- an admin command to reset the ban for a client, or remove a client from the ban list.
--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/973945-fail2ban-log-and-unban?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).So it's not beautiful, but https://github.com/znc/znc/pull/411 seems to work for the logging.
Ok, so #411 is useless due to my lack of C++ knowledge.
Any thoughts on this, or update on #32? We're running a common ZNC instance at our company for our internal IRC network, and currently have ~45 users on the ZNC instance. When everyone is in the office and has the same source IP, and someone's client is misbehaving, fail2ban kicks everyone off. Some sort of logging (or even better, unban) is desperately needed...
I think this is not releated to fail2ban, but "anonymous IP limit" in webadmin and increasing it to something (lot higher) might help.
We've tried disabling fail2ban and it fixes it. The problem is that sometimes someone types the wrong password into their IRC client, and if their client is configured to reconnect too fast, fail2ban trips. Our office is behind NAT, so ZNC sees everyone in the office as coming from the same IP.
The more general issue is, why dosn't fail2ban log when it bans an IP, and why isn't there a way to either manually unban an IP, or to whitelist allowed IPs...
This will render fail2ban useless, you either have this only IP whitelisted, or not.
I was thinking that maybe some VPN solution between the office and ZNC could work.
@DarthGandalf Sorry if I was unclear about that... our office is behind NAT. Our ZNC instance is hosted offsite, and publicly available on the Internet so that we can connect from our phones, laptops, etc. I'd be fine with whitelisting just our office IP, our real concern (why we're running fail2ban) is if anyone in the outside world happens to discover our ZNC instance.