fail2ban / SSHGuard on computer -> send to iptables on router?

[Schuby]

Ok bear with me here and I'll explain what I'm trying to do.

I have a FreeNAS server setup that currently hosts a website that has a port forward rule on my router. I wanted to install fail2ban or SSHGuard in a seperate jailed environment and have it monitor each of my jail's connections (this can be done via mounting syslogs and whatnot, but I won't get into that).

What I'm hoping I can do is have that fail2ban (or SSHGuard) installation in my jailed environment send the block commands to my router (maybe using iptables?). That way the router is the one blocking the connections and not the jail itself.

Hopefully that makes sense, but I wanted to see if anyone had a similar configuration or experience running something like this.

The closest thing I found was this:

https://sourceforge.net/p/fail2ban/mailman/message/25619733/

But I'm having a hard time understanding how they accomplished it (or if it even worked).

Thoughts?

 

[sfx2000]

Ok bear with me here and I'll explain what I'm trying to do.

Ok I did - now I'll ask the question why?

Security is best when it is simple - think about what you are doing... you want Fail2Ban running on your NAS, with all your files/etc... even though you might be trying to run things in a jail, you really shouldn't be, at least not in this application..

Why are you doing this?

 

[Schuby]

Ok I did - now I'll ask the question why?

Security is best when it is simple - think about what you are doing... you want Fail2Ban running on your NAS, with all your files/etc... even though you might be trying to run things in a jail, you really shouldn't be, at least not in this application..

Why are you doing this?

I have about ten jails, each running a different service. Unfortunately you cannot modify the base of FreeNAS (well, you can, but it is not supported and can break things). I wanted to setup fail2ban to monitor the logs of each service and ban the offending IPs at the router level. If I could just install fail2ban onto the FreeNAS root, I would.

What other methods can I try?

 

[sfx2000]

You missed the important part of my post - why?

Actually I'll ask why you're running 10 jails on your filer (FreeNAS) with all of your important files/media/etc...

Security is always best when it is simple - what you are doing is not simple.. my advice - just don't...

Jails are nice and secure until they're not - but then it begs the question? What happens when one of them isn't 'right' and lets someone in... do you understand the context of what you're doing already, and trying to do?

Just because you can, does it mean you should?

 

[sfx2000]

In other words - I'm not going to help you shoot yourself in the foot...

 

[Schuby]

You missed the important part of my post - why?

Actually I'll ask why you're running 10 jails on your filer (FreeNAS) with all of your important files/media/etc...

Security is always best when it is simple - what you are doing is not simple.. my advice - just don't...

Jails are nice and secure until they're not - but then it begs the question? What happens when one of them isn't 'right' and lets someone in... do you understand the context of what you're doing already, and trying to do?

Just because you can, does it mean you should?

I understand what you are saying. I don't have any sensitive files on my FreeNAS box. This is more for a fun project with the side benefit of possibly hardening the network.

No worries. I appreciate the warning and will look at other simpler options that might be beneficial.