fail2ban-nginx-subnet

Fail2ban setup for nginx reverse proxy logs with subnet bans (/24) using nftables.

This repository is sanitized for paths:

• no host-specific container names
• no hardcoded absolute paths (all configurable)

What it installs

• Custom action: nftables-subnet24.conf
• Custom filter: nginx-badbots-proxy.conf
• Jail: nginx-badbots-subnet

Requirements

• Debian/Ubuntu with:
  • fail2ban
  • nftables
  • nginx

Quick install

sudo bash scripts/install.sh \
  --f2b-dir /etc/fail2ban \
  --nginx-access-log /var/log/nginx/access.log \
  --ignoreip "127.0.0.1/8 ::1 195.201.149.167" \
  --maxretry 3 \
  --findtime 5m \
  --bantime 1h

Verify

sudo fail2ban-client status
sudo fail2ban-client status nginx-badbots-subnet
sudo nft list table inet f2b-table

Notes

• This setup bans /24 once one offending IP crosses the retry threshold.
• Blackbox Exporter is ignored in the filter by default.
• Tweak failregex/ignoreregex for your exact log format.