Issue Firewall IP Ban (fail2ban) Wordpress

[Alaa Mansour]

Hello, everybody, after I have migrated the server, fail2ban no longer ban ip addresses automatically, and put them in a list in the firewall, I have to di it manually, even though the rules of the jails are as same as previous.
I can see the IP address in the list of banned ip under the jail, but I want a permanent ban in the firewall.

what I'm missing?
thanks

 

[seqoi]

I am trying to understand your issue but I can't. I believe you have wrong expectations. Fail2Ban doesn't ban anything automatically (hence I am probably misunderstanding you - I am not native English speaker). It will ban only if a specific trigger happens. From your screenshot it seems it is working fine.

Moreover (this is open for debate) but I don't think you'll have any tangible success in permanently adding some IP ranges into anything because most of the serious attackers rotate their IP ranges anyway. Meaning that they change their IP all the time.

That's why (for example) when you go to Fail2Ban settings you'll see that "IP address ban period" is set to a very short amount of time, not permanent. You can set it to whatever but I don't think this will yield any success in practice. Actually opposite. It can cause practical issues for someone legit. If you closely inspect Wordfence firewall (as another example), they also suggest banning for only a couple of hours/minutes, not permanently.

 

[Alaa Mansour]

I am trying to understand your issue but I can't. I believe you have wrong expectations. Fail2Ban doesn't ban anything automatically (hence I am probably misunderstanding you - I am not native English speaker). It will ban only if a specific trigger happens. From your screenshot it seems it is working fine.

Moreover (this is open for debate) but I don't think you'll have any tangible success in permanently adding some IP ranges into anything because most of the serious attackers rotate their IP ranges anyway. Meaning that they change their IP all the time.

That's why (for example) when you go to Fail2Ban settings you'll see that "IP address ban period" is set to a very short amount of time, not permanent. You can set it to whatever but I don't think this will yield any success in practice. Actually opposite. It can cause practical issues for someone legit. If you closely inspect Wordfence firewall (as another example), they also suggest banning for only a couple of hours/minutes, not permanently.

I have added all these IP address manually, I have enabled (IP address ban period = 604800 seconds)