Hi there, I am hosting a service for mainly me and also some family members. I want it to become more.
Currently the chain just as follows: interwebz <-> UDM <-> npm <-> services. The services are mostly run in VMs or LXCs, npm runs in docker, accompanied by one Adguard home instance and another AGH instance in an LXC.
I now want to add f2b to this whole chain. I’ve installed f2b in the OS which runs docker (and therefore npm) (VM1) and also in the OS of my existing service (VM2). Both VMs use Ubuntu as their OS.
What I already figured out thru testing and reading is, that f2b in VM2 acts as expected when the jail is triggered, and sets the block. But nftables/ufw don’t block connections coming from external, as they are coming thru npm. f2b sees and uses the public IP for the checks/bans.
So now I am thinking how to solve that.
- Keep f2b on VM2 and let it set the bans on VM1 over SSH. That’s what some people do or so I’ve read.
- Use f2b on VM1, let it check logs on VM2 and then set the bans. That would also be possible over SSH, I’d guess. But I didn’t read up on it yet.
So, what’s your opinion? How do you fine folks handle that in your environment? Option 2 seems to be more elegant, as it would be “at the entry” and let’s me easily add additional services later. But I don’t know, if that’s a path worth digging in to.
I used fail2ban as an anti-scraper strategy for a few months. It helped with the really basic scrapers that only use one or a few IP addresses.
But then they adapted and started using hundreds or thousands of different IP addresses, each one only making a couple of requests. fail2ban became counter-productive as it slowed my server down - the log files it was monitoring became massive under high load and it needs to scan the log files often to check if an IP has been seen before.
I’m not saying don’t try it, I’m saying it’s only effective in some situations.
Thank you for bringing that up, I was wondering that too. As in: “This one has something to hide. Let’s poke harder.”
Did you try CrowdSec as someone else suggested? Could that be a mitigation as those IPs could be filtered out in the long run, if I understand the concept of CS correct?
I did not, it seemed complicated and rabbit-hole-y.
In the end I just added an Anubis-like feature into PieFed. It works great.