Differences

This shows you the differences between two versions of the page.

--- wiki:fail2ban_examples [2022/12/27 12:27] – [Port 80 ban] change config examples and log lines antisa
+++ wiki:fail2ban_examples [2024/03/06 13:02] (current) – add example of dry run antisa
@@ Line 51: / Line 51: @@
 </WRAP>
+===== Testing =====
+==== regex ====
 Use ''fail2ban-regex'' to check if its matching the regex. Here is an example of match
@@ Line 90: / Line 93: @@
 .21.21.1 - - [27/Dec/2022:11:57:15 +0100] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0"
 </code>
+==== dry run ====
+Use action ''dummy.conf'' from //action.d/// directory to see what would be banned. E.g.
+  [bottest]
+  enabled  = true
+  maxretry = 4
+  findtime = 60s
+  bantime  = 60s
+  action   = dummy
+  #action   = iptables[name=bloKKKED, port=http]
+  logpath  = %(nginx_access_log)s
+Then ''cat /var/run/fail2ban/fail2ban.dummy'' to see what IPs would be banned.
 ====== Troubleshooting ======
@@ Line 105: / Line 122: @@
 check your filter's //dateformat// line it could be incorrectly matching the log lines.
+===== Not banning after action change =====
+If you changed the action to be used in jail, for example from iptables to shorewall it might not work even after restart, workaround is to (re)move the sqlite database and restart e.g.
+  mv /var/lib/fail2ban/fail2ban.sqlite3 /tmp/ && systemctl restart fail2ban
 ====== Tested on ======
   * fail2ban 0.11.2