allow-iptables-multiport.conf

# Fail2Ban configuration file for allowing hosts
#
#

[INCLUDES]

before = iptables-blocktype.conf

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = iptables -N f2b-<name>
              iptables -A f2b-<name> -j <blocktype>
              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
             iptables -F f2b-<name>
             iptables -X f2b-<name>

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck = iptables -n -L <chain> | grep -q 'f2b-<name>[ \t]'

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = iptables -I f2b-<name> 1 -s <ip> -j <allowtype>

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban = iptables -D f2b-<name> -s <ip> -j <allowtype>

[Init]

# Default name of the chain
#
name = default

# Option: allowtype
# Notes: ACCEPT skips other chains
# Value: [ RETURN | ACCEPT ]
#
allowtype = RETURN

# Option:  port
# Notes:  specifies port to monitor
# Values:  [ NUM | STRING ]  Default: ftp
#
port = ftp

# Option:  protocol
# Notes:  internally used by config reader for interpolations.
# Values:  [ tcp | udp | icmp | all ] Default: tcp
#
protocol = tcp

# Option:  chain
# Notes:   specifies the iptables chain to which the fail2ban rules should be
#          added
# Values:  STRING  Default: INPUT
chain = INPUT

# Author: Viktor Szépe

apache-pass.conf

# Fail2Ban apache pass filter
# for access.log only
#
# NOT for error.log
#

[Definition]

# "\w+" means the user is authorized
failregex = ^<HOST> - \w+ \[ [\+-]\d{4}\] "GET <knocking_url> HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$

ignoreregex =

[Init]

knocking_url = /knocking/

# Author: Viktor Szépe

jail.local

# sample jail.local

[pass2allow]
# allow FTP login after successful HTTP auth
enabled = true
filter = apache-pass
banaction = allow-iptables-multiport
# authorization-website's access.log
logpath = /var/log/nginx/access.log
port = ftp,ftp-data,ftps,ftps-data
protocol = tcp
# allowtime
bantime  = 3600
# small value
findtime  = 1
# allow at once
maxretry = 1