Question Excessive fail2ban banned hosta may flood memory?

[Jose Maria Sarachaga]

Hello guys

I'm using fail2ban in Plesk working pretty smoothly. I extended BAN period to months (instead of just some minutes), and the list of banned hosts grows as expected. At this time the list of banned hosts is about 8K, not a problem at all, for now.

My question is if an excessive number of banned hosts might lead to other problem, like memory flooding, or iptables/kernel crash?

I see it's all about iptables rules but don't know if all these rules are stored in memory or a file, for realtime lookup.

As i said, i have no problems at this time, just thinking ahead.

Regards

 

[Bitpalast]

Fail2Ban uses iptables and iptables stores rules in its own "database". I am not aware of a limit, but 8,000 sounds like a whole lot. One downside of that is that it will most definitely slow down your network interface, because each connection needs to run through all these entries before it is passed or dropped.

Are you aware that you also have a "recidive" jail in Fail2Ban? If you combine a short drop for first time offenders with a long drop for repeating offenders you normally don't need thousands of jail entries. All the first time offenders and one shot attempts will be blocked for a short time, the repeating offenders will remain in iptables for a longer time. You'll maybe only have a fourth of your current entries.

 

[Jose Maria Sarachaga]

Fail2Ban uses iptables and iptables stores rules in its own "database". I am not aware of a limit, but 8,000 sounds like a whole lot. One downside of that is that it will most definitely slow down your network interface, because each connection needs to run through all these entries before it is passed or dropped.

Are you aware that you also have a "recidive" jail in Fail2Ban? If you combine a short drop for first time offenders with a long drop for repeating offenders you normally don't need thousands of jail entries. All the first time offenders and one shot attempts will be blocked for a short time, the repeating offenders will remain in iptables for a longer time. You'll maybe only have a fourth of your current entries.

Thanks for your reply. Yes I’m aware of recidive, I will change the approach to what you suggest, I agree there will be a lot fewer hosts.