• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

fail2ban blocking ip but still can reach my server

Alex123456

New Pleskian
I am trying to secure my wordpress installations on my server from brute force attacks. After searching on forum i found that i have to make a new jail on fail2ban with contents
Code:
[wp-login]
enabled = true
filter = wp-login
action = iptables-multiport[blocktype="DROP", name="wp-login", port="http,https"]
sendmail[dest="[email protected]", sender="fail2ban", sendername="Fail2Ban", name="wp-login"]
logpath = /var/www/vhosts/system/*/logs/*access*log
maxretry = 3

Jail is working and i can see some banned ip on fail2ban Banned Ip tab and on iptables list, but when i am looking my sites access logs these ips still trying to brute force me.
Code:
87.xxx.193.xxx - - [07/Jan/2015:12:46:43 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
87.xxx.193.xxx - - [07/Jan/2015:12:46:48 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
87.xxx.193.xxx - - [07/Jan/2015:12:46:53 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
87.xxx.193.xxx - - [07/Jan/2015:12:46:58 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"

Any help appreciated
 
Back
Top