Firewall
Fail2ban Blocklist Tutorial
Combine Fail2ban with AntiProxies static blocklists to proactively ban known VPN, proxy and Tor IPs before they even attempt a request, at the system firewall level.
Steps
- 1
Install Fail2ban
Install Fail2ban with apt install fail2ban or yum install fail2ban. It uses iptables/nftables under the hood.
- 2
Create a custom jail
Add a jail configuration that loads a static ban file rather than watching log files. Fail2ban can ban IPs via its action mechanism even without log parsing.
- 3
Write an action file
Create a custom action that reads from the AntiProxies blocklist and uses iptables to block each IP.
Need the blocklist files?
The annual license includes every format and monthly data releases.
Get the complete lists Inspect sample dataCustom jail config
Fail2ban jail that loads a static IP ban list on startup.
[antiproxies]
enabled = true
filter = antiproxies
action = antiproxies-blocklist
logpath = /etc/fail2ban/blocklists/blocked_ips.txt
maxretry = 1
findtime = 86400
bantime = -1Custom action file
Action that creates an iptables chain for AntiProxies bans.
[Definition]
actionstart = iptables -N f2b-antiproxies
iptables -A INPUT -j f2b-antiproxies
# Pre-load all IPs from blocklist
while IFS= read -r ip; do
[[ -z "$ip" || "$ip" == "#"* ]] && continue
iptables -A f2b-antiproxies -s $ip -j DROP
done < /etc/fail2ban/blocklists/blocked_ips.txt
actionstop = iptables -D INPUT -j f2b-antiproxies
iptables -F f2b-antiproxies
iptables -X f2b-antiproxies
actionban = iptables -I f2b-antiproxies -s <ip> -j DROP
actionunban = iptables -D f2b-antiproxies -s <ip> -j DROPFrequently asked questions
What is the difference between Fail2ban and ipset for this use case?
Does bantime = -1 mean permanent ban?
Put the full dataset in your stack
€99/year gets you all 22 data categories, unlimited local queries, and one year of updates. Load the files once, keep your decision logic in-house, and update on your own deployment schedule.