Blocking IP addresses using Fail2ban with Nginx

Today, I was reviewing the logs of automated site parsing attempts and noticed about a dozen fake User-agents from the same IP address.

Here's our culprit:

91.123.13.180 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
91.123.13.180 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.3
91.123.13.180 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
91.123.13.180 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.3
91.123.13.180 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Trailer/93.3.8652.5
91.123.13.180 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.3
91.123.13.180 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.3
91.123.13.180 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.10 Safari/605.1.1
91.123.13.180 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.3

A fake version of Google Chrome "Chrome/134.0.0.0" is used here, as well as other rather suspicious versions for Opera and Edg. Also, considering the number of access attempts in the logs, it can be said that this is clear automation.

Therefore, I decided to use Fail2ban, which allows blocking IP addresses that have a large number of connections for a while or permanently. For automating the blocking, exceeding limits from Nginx will be used.

Nginx Configuration

If you haven't set this up yet, you can do it as follows. In your site configuration file, add the following:

server {
    location / {
        limit_req zone=req_limit_per_ip burst=20 nodelay;
    }
}

Or more advanced site settings. Then check that the Nginx config is okay.

sudo nginx -t

If there are errors, fix them; if not, restart Nginx

sudo systemctl restart nginx.service

Fail2ban Configuration

Install Fail2ban

sudo apt update
sudo apt install fail2ban

Then go to the /etc/fail2ban/ directory

cd /etc/fail2ban/

And make a copy of the main configuration

sudo cp jail.conf jail.local

Do not touch the main configuration, only change the local one.

In the

[DEFAULT]

section, it is advisable to specify your IP address in ignoreip to avoid blocking yourself.

ignoreip = 127.0.0.1/8 111.222.333.444/24

After that, you can configure the check of information from nginx for blocking by IP addresses.

The configuration might look like this for checking connection limits

[nginx-limit-req]
enabled = true
filter = nginx-limit-req
action = iptables[name=nginx-limit-req, port=http, protocol=tcp]
logpath = /var/log/nginx/error.log
maxretry = 5
findtime = 600
bantime = 3600

• maxretry

  — how many times it is allowed to exceed the limit in findtime seconds

• bantime

  — ban time in seconds (here 1 hour)

Restart fail2ban

sudo systemctl restart fail2ban

Check the status

sudo fail2ban-client status
sudo fail2ban-client status nginx-limit-req

Conclusion

Now I will continue to look in the log and search for something interesting. I believe this should improve the site's stability.