# Fail2ban not banning

**URL:** <https://vaultwarden.discourse.group/t/fail2ban-not-banning/675>\
**Category:** Help\
**Created:** [March 4, 2021, 1:25am UTC](https://vaultwarden.discourse.group/t/fail2ban-not-banning/675 "2021-03-04T01:25:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![goose](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/goose/32/235_2.png) [@goose](https://vaultwarden.discourse.group/u/goose)\
**Post date:** [March 4, 2021, 1:25am UTC](https://vaultwarden.discourse.group/t/fail2ban-not-banning/675/1 "2021-03-04T01:25:47Z")

</div>

I’m trying to use the `crazy-max/docker-fail2ban` docker container to enforce fail2ban rules on my BitWarden container. Of note, my container is named `bitwarden`, not `bitwarden_rs`.

Relevant bits of my compose:

```
  bitwarden:
    container_name: bitwarden
    hostname: bitwarden
    image: bitwardenrs/server:latest
    volumes:
      - "/docker/config/bitwarden:/data"
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      - "LOG_FILE=/data/bitwarden.log"
      - "WEBSOCKET_ENABLED=true"
      - "TZ=America/New_York"
    ports:
      - "3012:3012"
    restart: unless-stopped
    labels:
      - "com.ouroboros.enable=true"
    logging:
      driver: json-file
      options: 
        max-file: "3"
        max-size: "10M"
    network_mode: BucketNet

  fail2ban:
    container_name: fail2ban
    hostname: fail2ban
    image: crazymax/fail2ban:latest
    network_mode: "host"
    cap_add:
      - "NET_ADMIN"
      - "NET_RAW"
    volumes:
      - "/docker/config/fail2ban:/data"
      - "/var/log/auth.log:/var/log/auth.log:ro"
      - "/docker/config/bitwarden/bitwarden.log:/var/log/bitwarden.log:ro"
      - "/docker/config/nginx/var-log-nginx:/var/log/nginx:ro"
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      - "TZ=America/New_York"
    restart: unless-stopped
    labels:
      - "com.ouroboros.enable=true"
    logging:
      driver: json-file
      options: 
        max-file: "3"
        max-size: "10M"

```

My `action.d/iptables-common.local`:

```
[Init]
blocktype = DROP
[Init?family=inet6]
blocktype = DROP

```

My `filter.d/bitwarden.local`:

```
[INCLUDES]
before = common.conf
[Definition]
failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
ignoreregex =

```

My `jail.d/bitwarden.local`:

```
[bitwarden]
enabled = true
port = 80,443,8081
filter = bitwarden
action = iptables-allports[name=bitwarden, chain=FORWARD]
logpath = /var/log/bitwarden.log
maxretry = 3
bantime = 14400
findtime = 14400

```

Of note, my BitWarden is not exposed directly at all, but reverse proxy’ed via Nginx. I have proper headers forwarded, and when I test and check my fail2ban logs I see messages with the correct IP and stating that it’s banning the IP, but nothing happens and I’m still able to access BitWarden.

Any ideas?

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 4, 2021, 7:06am UTC](https://vaultwarden.discourse.group/t/fail2ban-not-banning/675/2 "2021-03-04T07:06:38Z")

</div>

Hello @goose,

One thing i noticed that you only expose port 3012 and not 80. Maybe a typo in the config.

Regarding the blocking. Those headers only report in text which IP is the source. For the network stack it still is a local, probably docker, IP range. You need to block on the nginx side of that is the main entry point.

The bitwarden container never receives the external source IP directly, and only via the nginx container.

---

<div class="post-metadata">

**Author:** ![goose](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/goose/32/235_2.png) [@goose](https://vaultwarden.discourse.group/u/goose)\
**Post date:** [March 4, 2021, 6:37pm UTC](https://vaultwarden.discourse.group/t/fail2ban-not-banning/675/3 "2021-03-04T18:37:52Z")

</div>

> [@BlackDex](#):
>
> One thing i noticed that you only expose port 3012 and not 80. Maybe a typo in the config.

This is because I don’t need to expose port 80, as Nginx (Which is also a docker container) is reverse-proxying it.

But what your saying makes sense, I need to have fail2ban act on Nginx, not on Bitwarden\_rs.

How do I modify the `jail.d/bitwarden.local` to do that?

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [March 4, 2021, 7:02pm UTC](https://vaultwarden.discourse.group/t/fail2ban-not-banning/675/4 "2021-03-04T19:02:09Z")

</div>

Best i think is to share that logfile also to the nginx container it self maybe?

---

<div class="post-metadata">

**Author:** ![Lithimlin](https://avatars.discourse-cdn.com/v4/letter/l/977dab/32.png) [@Lithimlin](https://vaultwarden.discourse.group/u/Lithimlin)\
**Post date:** [March 6, 2021, 2:21pm UTC](https://vaultwarden.discourse.group/t/fail2ban-not-banning/675/5 "2021-03-06T14:21:56Z")

</div>

Hey, I’m having the same issue. However, I’m using Caddy as a reverse proxy and have it set up to include the origin IP in the header via `header_up X-Real-IP {remote_host}`.  
I’ve got the fal2ban files set up in the same way as shown in [GitHub - sosandroid/docker-fail2ban-synology: Adaptation of @crazy-max docker fail2ban for Synology](https://github.com/sosandroid/docker-fail2ban-synology) now and it’s not working. I’m getting the following error:

```auto
fail2ban.utils [1]: ERROR b68beec0 -- stderr: "iptables v1.8.4 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)"
fail2ban.utils [1]: ERROR b68beec0 -- stderr: 'Perhaps iptables or your kernel needs to be upgraded.'
fail2ban.utils [1]: ERROR b68beec0 -- returned 3
fail2ban.actions [1]: ERROR Failed to execute ban jail 'bitwarden' action 'iptables-allports' info 'ActionInfo({'ip': '<my-ip>', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0xb65eb850>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0xb65ebbb0>})': Error starting action Jail('bitwarden')/iptables-allports: 'Script error'

```

---

<div class="post-metadata">

**Author:** ![stefan0xC](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/stefan0xc/32/1765_2.png) [@stefan0xC](https://vaultwarden.discourse.group/u/stefan0xC)\
**Post date:** [March 13, 2021, 7:16pm UTC](https://vaultwarden.discourse.group/t/fail2ban-not-banning/675/6 "2021-03-13T19:16:02Z")

</div>

> [@goose](#):
>
> How do I modify the `jail.d/bitwarden.local` to do that?

fail2ban should ban the remote IP address on the [INPUT chain](https://github.com/crazy-max/docker-fail2ban#docker-user-and-input-chains).