The Fail2ban section is used to configure intrusion prevention for the PBX system. It helps protect system services by monitoring suspicious access attempts and automatically banning IP addresses that exceed the configured failure limits.
Fail2ban is commonly used to reduce brute-force attacks, and repeated failed access attempts against exposed PBX services.
Fail2ban Service
Enable Service: Enables or disables Fail2ban protection.
Reset: Restores the Fail2ban configuration to its previous or default state.
Whitelist
The Whitelist section is used to define trusted IP addresses or networks that should not be banned by Fail2ban. Whitelisted entries are excluded from automatic blocking, even if they match detection rules.
Edit Whitelist: Allows administrators to update the trusted IP addresses or network ranges.
Blacklist
The Blacklist section displays IP addresses that have been banned by Fail2ban. These entries represent sources that triggered intrusion prevention rules based on repeated failed attempts or suspicious activity.
Settings
The Settings section is used to configure the global Fail2ban behavior, including ban duration, monitoring window, and retry limits.
Global Settings
- Ban Time: Defines how long an IP address remains banned after triggering Fail2ban rules.
- Find Time: Defines the time window used to count failed attempts.
- Max Retries: Defines the maximum number of failed attempts allowed within the find time before the IP address is banned.