502 Bad Gateway - Couln't contact fail2rest - After banning an IP

[elmerfds]

Describe the bug
I've managed to setup fail2web (f2w)/fail2rest (f2r) without any issues, fail2web is able to see all my jails etc. but when I try to manually ban an IP via f2w, command line or getting an IP banned via failed authentication attempts, it breaks the connection to f2r. At this point, f2w is no longer able to connect to f2r. The only way to get it working again is to unban the IP.

To Reproduce
Steps to reproduce the behavior:

• Either manually ban an IP via f2w or command line or failed authentication attempts.
  As soon as the IP is banned, I get the following error:
  

Provide Docker commands or docker-compose file if possible.

Expected behavior

• Fail2web should still be working after an IP is banned

Screenshots
If applicable, add screenshots to help explain your problem.

Container configs

Fail2web

Fail2rest

Docker (please complete the following information):

• Docker / Docker-compose Version: 18.09.3, build 774a1f4

Desktop (please complete the following information):

• OS: Unraid 6.7.0-rc7 but I've also tried it on Ubuntu (16.04, 18.04), same outcome
• Browser: Chrome, Edge Chromium
• Version : Chrome: 73.0.3683.103. Edge Chromium: 75.0.131.0

Smartphone (please complete the following information):
N/A

Additional context
I'm using the linuxserver/letsencrypt container for Nginx & Fail2ban.
I've also tried a dedicated fail2ban container, same issue
It works fine if my fail2ban instance is running locally, it fails if fail2ban is running on docker.

[madmath03]

Hi, Haven’t tried to reproduce it yet but I will share my first thoughts on it in case it might help you figure it out. First, when you say that you need to unban the IP again to get it to work, which IP are you referring to ? Is it your local Docker bridge IP, host server IP or the client IP exposed by the browser ? Maybe you could add your Docker bridge IP to fail2ban ignore list and see the results. If you have Docker services being monitored by a fail2ban Docker container, fail2ban will only see the Docker bridge IP, not the client IP behind the request. This means that by failed login attempts, you would not ban the user IP but the Docker bridge IP so all your apps in Docker would be banned... I’m pretty sure that I have manually banned IPs before without any issues so my guess would be that the problem might be coming from your fail2ban configuration. I feel even more sure that this is related to fail2ban itself since you mentioned banning from command line also triggered this error. Is there anything interesting in fail2ban logs ? I hope those leads might help you. I will investigate further next week if you haven’t solved your issue.

…

------------------------ Mathieu BRUNOT

Le 19 avr. 2019 à 19:43, elmerfdz ***@***.***> a écrit : Describe the bug I've managed to setup fail2web (f2w)/fail2rest (f2r) without any issues, fail2web is able to see all my jails etc. but when I try to manually ban an IP via f2w, command line or getting an IP banned via failed authentication attempts, it breaks the connection to f2r. At this point, f2w is no longer able to connect to f2r. The only way to get it working again is to unban the IP. To Reproduce Steps to reproduce the behavior: Either manually ban an IP via f2w or command line or failed authentication attempts. As soon as the IP is banned, I get the following error: Provide Docker commands or docker-compose file if possible. Expected behavior Fail2web should still be working after an IP is banned Screenshots If applicable, add screenshots to help explain your problem. Container configs Fail2web Fail2rest Docker (please complete the following information): Docker / Docker-compose Version: 18.09.3, build 774a1f4 Desktop (please complete the following information): OS: Unraid 6.7.0-rc7 but I've also tried it on a Ubuntu VM, same outcome Browser: Chrome, Edge Chromium Version : Chrome: 73.0.3683.103. Edge Chromium: 75.0.131.0 Smartphone (please complete the following information): N/A Additional context I'm using the linuxserver/letsencrypt container for Nginx & Fail2ban. I've also tried a dedicated fail2ban container, same issue It works fine if my fail2ban instance is running locally, it fails if fail2ban is running on docker. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[elmerfds]

Hi, thanks for the quick reply.

I was talking about the client IP, the fail2ban container is banning the correct IP (client IP) as per the logs, I've also tested this on my phone and it is indeed banning the client IP.

I had already excluded the docker bridge network on my fail2ban config.

[madmath03]

Okay. Well, that’s definitely weird then. Anything interesting in fail2ban logs ? Also, I’m thinking about fail2rest requests. If you enable developer tools in your browser, do you see anything weird or which request triggers the ban? In my case, we mostly use fail2ban to secure email servers and do not have such a problem. Did you try to look / post on fail2ban repository itself to find people with similar issues ?

…

------------------------ Mathieu BRUNOT

Le 19 avr. 2019 à 20:57, elmerfdz ***@***.***> a écrit : Hi, thanks for the quick reply. I was talking about the client IP, the fail2ban container is banning the correct IP (client IP) as per the logs, I've also tested this on my phone and it is indeed banning the client IP. I had already excluded the docker bridge network on my fail2ban config. — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub, or mute the thread.

[elmerfds]

Nothing unusual in the logs.

In your use case or in your test environment are you running fail2ban natively or is it running in a container? This issue only affects f2b running in a container. native f2b installs work fine with f2r/f2b.

[madmath03]

Our fail2ban is also in a container: https://github.com/tomav/docker-mailserver

I will take a look at linuxserver fail2ban config, see if there is something different that might explain this.

EDIT: I have not found anything in the configuration that might explain this behavior. I will have to reproduce your setup but this might take me some time.

[pto199]

I'm getting the same problem. Running this on Unraid, just like the OP (He never mentions it but you can tell from the screenshots). So its running in a docker container.