Chains INPUT vs DOCKER-USER - a way to cohabit about docker-fail2ban

[gauth-fr]

Well, i've just tried with chain = DOCKER-USER and it worked, so it's even simpler thanks!

Regarding the network mode, it doesn't change whatever is the default chain.

if it helps here is my docker-compose, which works with input and docker-user, and is just using what in the example folder:

services:
  fail2ban-input:
    image: crazymax/fail2ban:latest
    container_name: fail2ban-input
    network_mode: "host"
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - "...config/fail2ban:/data"
      - "/var/log:/var/log:ro"
    environment:
      - "F2B_IPTABLES_CHAIN=INPUT"      
      - "TZ=Europe/Paris"
      - "F2B_LOG_TARGET=/data/fail2ban.log"
      - "F2B_LOG_LEVEL=INFO"
      - "F2B_DB_PURGE_AGE=10w"
    restart: always```

[alexschomb]

Thanks for sharing. Just an untested idea: Wouldn't this work as well?

# jail.d/traefik.conf
[traefik-auth]
enabled = true
logpath = %(traefik_access_log)s
port = http,https
chain = DOCKER-USER
findtime = 600
maxretry = 3
bantime=1w

[traefik-botsearch]
enabled = true
logpath = %(traefik_access_log)s
maxretry = 1
bantime=4w
port = http,https
chain = DOCKER-USER

Actually, chain = DOCKER-USER is the default in my action.d/iptables-common.conf already. That would mean that you'd only need to set chain = INPUT for host services like sshd. But how about the networking then? I suppose network_mode: host still applies?

[alexschomb]

Great! Thanks for your feedback 👍

[crazy-max]

Hi guys, I will reconsider the implementation and probably remove the F2B_IPTABLES_CHAIN var. Will also fix #17

[crazy-max]

@alexschomb @gauth-fr F2B_IPTABLES_CHAIN env var has been removed and README updated to use chain = <name> def.