Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do these configs proactively block UDP by default? #26

Open
eiqnepm opened this issue Sep 19, 2024 · 1 comment
Open

Do these configs proactively block UDP by default? #26

eiqnepm opened this issue Sep 19, 2024 · 1 comment

Comments

@eiqnepm
Copy link

eiqnepm commented Sep 19, 2024

I am using HTTPS/3 for my reverse proxy, I have noticed that new attempts to visit the site are blocked, but existing connections are still able to attempt logins. Could this be because these configs aren't proactively blocking the existing TCP and or UDP connections?

jail.local

[DEFAULT]

# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time
bantime.increment = true

# "bantime.maxtime" is the max number of seconds using the ban time can reach (doesn't grow further)
bantime.maxtime = 5w

# "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier
bantime.factor = 24

# "bantime" is the number of seconds that a host is banned.
bantime = 1h

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 24h

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

# Prevents banning LAN subnets
ignoreip    = 127.0.0.1/8 ::1
              10.0.0.0/8
              172.16.0.0/12
              192.168.0.0/16

[vaultwarden-auth]
# configuration inherits from jail.d/vaultwarden-auth.conf
enabled = true
chain   = DOCKER-USER

[homeassistant-auth]
# configuration inherits from jail.d/homeassistant-auth.conf
enabled  = true
chain    = DOCKER-USER
port     = http,https

@eiqnepm
Copy link
Author

eiqnepm commented Sep 19, 2024

I changed protocol to all and banaction to all ports and the issue is resolved, I assume the prior did the trick as I assume HTTP/3 wasn't being blocked on the default config.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant