Playing around with fail2ban on a local docker host I found that when blocking a host, all docker containers with open ports where still accessible.

I tried several different ways of getting the IP block to really block everything.

This is some notes from the steps I took to solve the problem.

• Update your package lists

apt update

• Install fail2ban

apt install fail2ban

• We do not edit the default jail.conf since it can be overwritten by updates. So we create a new config for fail2ban.

vim /etc/fail2ban/jail.local

For this simple demonstration we are going to block all failed attempt over SSH. And we want to block the remote IP for 600s, for all services and ports.

[sshd]
ignoreip = 127.0.0.1
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime  = 600
findtime = 600
action = iptables-allports[actname=sshd,name=sshd,protocol=all]
         iptables-allports[actname=sshd-docker,name=sshd-docker,protocol=all,chain=DOCKER]

The trick was to setup two actions. One for the normal chain/traffic and one for dockers CHAIN.

Doing this block sessions not only to the host but also all containers.