Fail2ban and NPMplus

[tokar86a]

Hi

Have someone set up fail2ban together whit NPMplus ?

I have setup the following filter but it seems to be using Cloudflare IP instead of the real visitors IP. The logs is showing the right IP so this should be working? But maybe should use something else then HOST?

[INCLUDES]

[Definition]

failregex = <HOST>.*"(GET|POST).*" (404|444|403|400) .*$

Think i was able to fix it whit this

[INCLUDES]

[Definition]

failregex = <ADDR>.*"(GET|POST).*" (404|444|403|400) .*$

[Zoey2936]

sorry, I have no Idea of fail2ban configs, I can only recommend crowdsec to you, which can do the same as fail2ban

[tokar86a]

I was able to find a fix for it as i mention in the post. I wanted to have something together whit Crowdsec that could ban the IP on Cloudflare to before it get to my network.

[tokar86a]

Yes but then you have this problem:

warning

Currently use of this bouncer is discouraged if you are on free plan with Cloudflare due to rate limitations. We are working to resolve this with Cloudflare support.

If you are on a premium plan with Cloudflare contact thier support to ask about increasing your rate limit.

As i am using the free plan.

[Zoey2936]

yes, I'm too, but I think you need a huge list of IPs blocked by crowdsec to hit this API limit

[Zoey2936]

fail2ban has the same ratelimit

[tokar86a]

Yes that`s maybe the case but the list is only a few IP instead of the entire Crowdsec list.

[tokar86a]

The main reason for this is at that i sometime keep getting alerts about the same IP trying to access to server and whit help of Crowdsec that ban first and Fail2Ban kick in if the person keep trying. So it`s like double ban system.

[Zoey2936]

I was able to find a fix for it as i mention in the post.

can you maybe post if for other people?

[tokar86a]

I post the fix for me in the topic?

I have also use this tutorial: [
](https://blog.lrvt.de/fail2ban-with-nginx-proxy-manager/)
But here it is again

[INCLUDES]

[Definition]

failregex = <ADDR>.*"(GET|POST).*" (404|444|403|400) .*$