DMS fail2ban behind proxy

[mgmfr]

I use DMS behind traefik so some feature does not work as intended. Anyone tried to use fail2ban in such a scenario ?
DMS does indeed set the IP in jail but the jailed IPs continue to try to connect because fail2ban instance locale to the container uses INPUT to filter when the traffic is FORWARDED by the proxy.

I made it work by tweaking fail2ban on the host and made a very basic and simple private git repo but before i go any further, maybe someone already had a better idea than mine.

[Ziomal12]

Hey, I've just came up with a workaround for exactly this problem. In dms/config I've created two files, one:
user-patches.sh

and second file, which is modified /etc/fail2ban/action.d/ufw.conf
ufw.conf

Of course since I'm using UFW I have it installed on my proxy server and public key derived from private key in this script is installed on the proxy.
What this does is anytime fail2ban deems IP should be banned it passed ufw command over ssh (which this script also installs in container) to the proxy server, banning the ip.

Would you mind sharing your solution?

[mgmfr]

Hey, i see what you did, I will switch the repo from private to public so you can have a look. Basicaly, as I understood what was going on with packets and given that i already had a fail2ban running on the host, i wanted to use this instance as directly as possible for simplicity. It turns out that having fail2ban to work on different iptables chain is not as straight forward as I thought.
My solution does work as intented but should be considered a proof of concept because It might not work on your use case ( dependending on HOST OS, fail2ban version, netfilter "frontend" and so on ).

What I did was using bind mounts in DMS which allows me to access logs from the host. Then, I point the host's fail2ban to the DMS logs. To handle it, I used existing scripts for postfix or dovecot, created 2 config files :

• action file which describes action to be taken ( basicaly a copy of iptables-multiport.conf but using the chain FORWARD )
• jail file which describes the jail and points fail2ban to the correct log file.