The Fail2ban section is used to configure intrusion prevention for the PBX system. It helps protect system services by monitoring suspicious access attempts and automatically banning IP addresses that exceed the configured failure limits.
Fail2ban is commonly used to reduce brute-force attacks, and repeated failed access attempts against exposed PBX services.
Status Controls
- Start: Activates Fail2ban monitoring(activated by default).
- Stop: Deactivates Fail2ban protection.
- Status: Displays whether Fail2ban is currently running.
Whitelist
The Whitelist section is used to define trusted IP addresses or networks that should not be banned by Fail2ban. Whitelisted entries are excluded from automatic blocking, even if they match detection rules.
Edit Whitelist: Allows administrators to update the trusted IP addresses or network ranges.
Settings
The Settings section is used to configure the global Fail2ban behavior, including ban duration, monitoring window, and retry limits.
- Ban Time: Defines how long an IP address remains banned after triggering Fail2ban rules.
- Find Time: Defines the time window used to count failed attempts.
- Max Retries: Defines the maximum number of failed attempts allowed within the find time before the IP address is banned.
The Reset button is used to revert changes made
Blacklist
The Blacklist section displays IP addresses that have been banned by Fail2ban. These entries represent sources that triggered intrusion prevention rules based on repeated failed attempts or suspicious activity.
Once the ban time expires, the IP is automatically removed unless it’s caught again.
In the Action column, clicking it will manually remove (unban) the IP from the blacklist before the ban time expires.