<clever>
tcpdump shows no sign of a connecting being refused
<clever>
wtf?
<clever>
nmap shows all the expected ports as being open on the router, except 22
<clever>
wtf?
<gchristensen>
:o
<clever>
10:26:15.693263 IP 192.168.2.1 > 192.168.2.32: ICMP 192.168.2.1 tcp port 22 unreachable, length 68
<clever>
aha!
<clever>
it was icmp, so my filter excluded it
<clever>
-A f2b-SSH -s 192.168.2.32/32 -j REJECT --reject-with icmp-port-unreachable
<clever>
gchristensen: wut...
<clever>
Nov 27 14:19:17 router .fail2ban-serve[1218]: fail2ban.actions [1218]: NOTICE [ssh-iptables] Ban 192.168.2.32
<andi->
So, lets talk fail2ban. What does it really provide you? We all agree that there should not be any password logins. Right?
<andi->
I constantly run into scenarios where some (grey bearded) admin installed fail2ban on production systems. Whenever I am on a train or some other flaky network I hit the ~30min ban timer because connecting sometimes just fails for 3 times in a row (me being slow typing an OTP, the network dropping in the middle of the handshake, …)
<gchristensen>
I run it out of habit :x
<clever>
i just turned it on becayse "why not" and then forgot to configure anything within it, lol