Creating a fail2ban proxy filter

Creating a fail2ban proxy filter

I recently discovered the usefulness of fail2ban whilst researching a way to block proxyheader.php requests on my LAMP server.

The request always came from the same location and the same IP's:

58.218.199.147
58.218.199.250
58.218.199.227

A whois on these IP's reveal that they're based in China - Bejing to be exact - and the people using them are probably searching for proxy servers to avoid the Great FW of China, but who knows really.

When I used Apache I needed to adjust the /etc/fail2ban/filter.d/apache-proxy.conf filter to get it to work:

# Fail2Ban configuration file
#
# Author: James Roe
# Use in apache access logs
[Definition]
# Matches lines such as:
# 192.168.1.1 - - "GET http://www.infodownload.info/proxyheader.php ...
failregex = ^(?:(?![0-9\.]* -.*"[A-Z]* (/|.*HTTP/1\.[0-9]" (301|302))))
ignoreregex =

Place this in /etc/fail2ban/jail.d/apache-proxy.conf:

[apache-proxy]
enabled = true
port    = http,https
filter  = apache-proxy
logpath = /var/log/httpd/*access_log
maxretry = 0
findtime = 604800
bantime = 604800

Not releavant for me anymore, since I stopped using Apache, it is better to check fail2ban site instead: Fail2ban