diff --git a/filter.d/traefik-404.conf b/filter.d/traefik-404.conf new file mode 100644 index 0000000..8562e67 --- /dev/null +++ b/filter.d/traefik-404.conf @@ -0,0 +1,15 @@ +## Version 2023/03/06 +# Fail2Ban filter configuration for traefik 404 +# Count 404 hits as potential threat actors e.g. bots blind scanning or DNS walking +# WARNING: This is an extremely aggressive filer. +# Unless you are certain you need it you almost certainly do not. +# ignoreip's are required as you WILL see false positives. + +[INCLUDES] + +before = common.conf + +[Definition] + +failregex = ^.*"(GET|POST|HEAD).*HTTP\/[0-9]+(.[0-9]+)?"\ (404)\ .*$ +ignoreregex =