A fail2ban try.

[F-TD5X]

Note

Basically this is for self-host user who needs fail2ban to ban some noisy scanning.

Modify them to fit your needs.

Docker Compose

Here is an example of a docker-compose.yaml file to create the stack. Note that due to the latest change, there may be some file permission problems with the socket and log files (because I'm using Docker, and Podman may not meet these requirements). You need to grant permissions for UID 1000 for these files.

services:
  warpgate:
    image: ghcr.io/warp-tech/warpgate:latest
    ports:
      - 22:2222
    volumes:
      - ./warpgate.toml:/data/warpgate.toml
      - warpgate-data:/data
      - vector-tmp:/tmp/logs
    stdin_open: true
    tty: true
    depends_on:
      - vector
    restart: unless-stopped
  vector:
    image: timberio/vector:latest-alpine
    container_name: warpgate_vector
    command: ["--config", "/etc/vector/vector.toml"] 
    user: "1000:1000"
    volumes:
      - ./vector.toml:/etc/vector/vector.toml:ro
      - vector-tmp:/tmp/logs
      - /var/log:/var/log
    restart: unless-stopped
volumes:
  warpgate-data:
  vector-tmp:

warpgate.yaml

just your config, but add these lines.

log:
  send_to: /tmp/logs/warpgate.sock

vector.toml

vector config, change to what you like

[sources.warpgate_socket]
type = "socket"
path = "/tmp/logs/warpgate.sock"
mode = "unix_datagram"

[transforms.warpgate_json_transform]
type = "remap"
inputs = ["warpgate_socket"]
source = ". = parse_json!(.message)"

[sinks.warpgate_file]
type = "file"
inputs = ["warpgate_json_transform"]
path = "/var/log/warpgate.log"

[sinks.warpgate_file.encoding]
codec = "logfmt"

What your log would looks like

client_ip=157.66.34.63 message="Password auth as <root for >" session=510736a0-05e8-4449-bde4-4eb943f62fab timestamp=2025-08-06T07:26:21.634102738+00:00
client_ip=157.66.34.63 error="user root not found" message="Failed to verify credentials" session=510736a0-05e8-4449-bde4-4eb943f62fab timestamp=2025-08-06T07:26:21.636321725+00:00

fail2ban configs

filter

[Definition]
failregex = ^.*client_ip=<HOST>.*error=".*".*message="Failed to verify credentials".*$ 
ignoreregex =
datepattern = timestamp=%%Y-%%m-%%dT%%H:%%M:%%S

jail

[warpgate]
enabled = true
port = ssh,22
filter = warpgate
logpath = /var/log/warpgate.log
maxretry = 5
findtime = 600
bantime = 3600
backend = auto
action = iptables-multiport[name=warpgate, port="ssh", protocol=tcp]

---

Now you can ban some script kiddles.

Status for the jail: warpgate
|- Filter
|  |- Currently failed:	8
|  |- Total failed:	138
|  `- File list:	/var/log/warpgate.log
`- Actions
   |- Currently banned:	9
   |- Total banned:	9
   `- Banned IP list:	178.27.90.142 213.6.203.226 48.217.234.252 185.255.90.146 43.154.195.142 27.112.79.123 157.66.34.63 185.247.206.140 45.117.208.82

[F-TD5X]

update: for using with docker network. you needs a docker-action.conf rather iptables-multiport.

[Definition]
actionstart = iptables -w -N f2b-<name> 2>/dev/null || true
              iptables -w -C f2b-<name> -j RETURN 2>/dev/null || iptables -w -A f2b-<name> -j RETURN
              iptables -w -C DOCKER-USER -j f2b-<name> 2>/dev/null || iptables -w -I DOCKER-USER 1 -j f2b-<name>

actionstop = iptables -w -D DOCKER-USER -j f2b-<name> 2>/dev/null || true
             iptables -w -F f2b-<name> 2>/dev/null || true
             iptables -w -X f2b-<name> 2>/dev/null || true

actioncheck = iptables -w -C DOCKER-USER -j f2b-<name>

actionban = iptables -w -I f2b-<name> 1 -s <ip> -j DROP

actionunban = iptables -w -D f2b-<name> -s <ip> -j DROP

[Init]
name = default