iptables: No chain/target/match by that name about docker-fail2ban

[crazy-max]

@bmccorm2 F2B_IPTABLES_CHAIN env var has been removed and README updated to use chain = <name> def. Can you try with this new behavior?

[bmccorm2]

Cool thanks I think that is a good change. I was going along the same lines with my setup (now have one container and would specify the chain within the jail.conf file) But I am still getting that same error.

And today I just tried installing fail2ban on the host and running it and it worked perfectly fine. I don't know if i have some setup issue but docker-fail2ban image will not write to my IP tables for DOCKER-USER chain. I use the same default action for postfix in the container as I do for the host package but for whatever reason it fails in the container. I can go into the container and verify those commands fail but i don't know enough about iptables to be able to fix it.

• docker-compose.yml

  f2b:
    image: crazymax/fail2ban
    container_name: f2b
    network_mode: "host"
    cap_add:
      - NET_ADMIN
      - NET_RAW
    env_file:
      - env/f2b.${ENV}.env
    volumes:
      - /opt/f2b:/data
      - /var/log:/var/log:ro
    restart: always

• f2b.prd.env

TZ=America/Denver

F2B_LOG_TARGET=STDOUT
F2B_LOG_LEVEL=INFO
F2B_DB_PURGE_AGE=1d

• postfix.conf

[postfix]
enabled = true
# To use another modes set filter parameter "mode" in jail.local:
filter  = postfix[mode=aggressive]
port    = smtp,465,submission
chain = DOCKER-USER
logpath = %(postfix_log)s
backend = %(postfix_backend)s

• Fail2ban Logs

2020-07-30 16:39:25,498 fail2ban.actions        [1]: NOTICE  [postfix] Ban 212.70.149.67
2020-07-30 16:39:25,501 fail2ban.observer       [1]: INFO    [postfix] IP 212.70.149.67 is bad: 1 # last 2020-07-30 03:57:44 - incr 1:00:00 to 10:00:44
2020-07-30 16:39:25,502 fail2ban.observer       [1]: NOTICE  [postfix] Increase Ban 212.70.149.67 (2 # 10:00:44 -> 2020-07-31 02:40:08)
2020-07-30 16:39:25,509 fail2ban.utils          [1]: ERROR   7f84ad282510 -- exec: iptables -w -N f2b-postfix
iptables -w -A f2b-postfix -j RETURN
iptables -w -I DOCKER-USER -p tcp -m multiport --dports smtp,465,submission -j f2b-postfix
2020-07-30 16:39:25,510 fail2ban.utils          [1]: ERROR   7f84ad282510 -- stderr: 'iptables: Chain already exists.'
2020-07-30 16:39:25,510 fail2ban.utils          [1]: ERROR   7f84ad282510 -- stderr: 'iptables: No chain/target/match by that name.'
2020-07-30 16:39:25,510 fail2ban.utils          [1]: ERROR   7f84ad282510 -- returned 1
2020-07-30 16:39:25,511 fail2ban.actions        [1]: ERROR   Failed to execute ban jail 'postfix' action 'iptables-multiport' info 'ActionInfo({'ip': '212.70.149.67', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7f84ad942e50>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7f84ad941550>})': Error starting action Jail('postfix')/iptables-multiport: 'Script error'
2020-07-30 16:39:31,207 fail2ban.filter         [1]: INFO    [postfix] Found 212.70.149.67 - 2020-07-30 16:39:31