• Hi, Pleskians! We are running a UX testing of our upcoming product intended for server management and monitoring.
    We would like to invite you to have a call with us and have some fun checking our prototype. The agenda is pretty simple - we bring new design and some scenarios that you need to walk through and succeed. We will be watching and taking insights for further development of the design.
    If you would like to participate, please use this link to book a meeting. We will sent the link to the clickable prototype at the meeting.
  • Our UX team believes in the in the power of direct feedback and would like to invite you to participate in interviews, tests, and surveys.
    To stay in the loop and never miss an opportunity to share your thoughts, please subscribe to our UX research program. If you were previously part of the Plesk UX research program, please re-subscribe to continue receiving our invitations.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

fail2ban blocking ip but still can reach my server

Alex123456

New Pleskian
I am trying to secure my wordpress installations on my server from brute force attacks. After searching on forum i found that i have to make a new jail on fail2ban with contents
Code:
[wp-login]
enabled = true
filter = wp-login
action = iptables-multiport[blocktype="DROP", name="wp-login", port="http,https"]
sendmail[dest="[email protected]", sender="fail2ban", sendername="Fail2Ban", name="wp-login"]
logpath = /var/www/vhosts/system/*/logs/*access*log
maxretry = 3

Jail is working and i can see some banned ip on fail2ban Banned Ip tab and on iptables list, but when i am looking my sites access logs these ips still trying to brute force me.
Code:
87.xxx.193.xxx - - [07/Jan/2015:12:46:43 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
87.xxx.193.xxx - - [07/Jan/2015:12:46:48 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
87.xxx.193.xxx - - [07/Jan/2015:12:46:53 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
87.xxx.193.xxx - - [07/Jan/2015:12:46:58 +0200] "POST /wp-login.php HTTP/1.0" 200 2355 "http://www.mysite.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"

Any help appreciated
 
Back
Top