I wonder how fail2ban is really banning ips in unraid with this config.

_[npm]

_{backend = auto}

_{enabled = true}

_{port = 80,443}

_{protocol = all}

_{filter = npm}

_{maxretry = 5}

_{ignoreip = 127.0.0.1/8 192.168.50.0/24}

_{action = iptables-multiport[blocktype=DROP]}

_{bantime = 48h}

_{findtime = 400m}

_{logpath = /var/log/default-host_*.log}

_{/var/log/proxy-host-*.log}

_{banaction = ufw}

Is that the right way or do i have to use another config?

Edited May 25, 20251 yr by TimTaylor

That looks like a jail. Where is Fail2ban installed on Unraid?

It's not on my install. At least, on my machine it's not in the typical install directory ie: /etc and there are no log files for it either.

Its a docker container (crazymax/fail2ban:latest), and it reads the NPM logs.

It also seems to detect something but that jail thing i dont understand...how can the docker set the bans to the real unraid system.
I think that config action = iptables-multiport[blocktype=DROP] and banaction = ufw seems to be the problem.