Fail2ban behind Cloudflare — how to ban without using the CF API?

1

Setup: HestiaCP + nginx on Ubuntu 24.04

All HTTP/HTTPS traffic passes through Cloudflare (active proxy), and the cloud firewall only releases Cloudflare’s IP addresses. Please note, there is no direct connection to the server.

The real_ip is already configured (set_real_ip_from as CF settings + real_ip_header CF-Connecting-IP), then the log of nginx records the real IP of the visitor and the fail2ban correctly identifies the offender.

The problem is or ban em if: the action usually uses iptables/nftables, but the package always checks Cloudflare’s IP, never the real IP. The door never comes home and the block does not have any effect.

I wanted to avoid the action cloudflare-token (API), due to rate limit, token to maintain and more an external dependence to break in silence.

I thought about some alternatives:

  1. Nginx blocking: o fail2ban escreve deny IP; include file number and reload. It works, but only with the receipt of the volume of reloads at peak of varredura.
  2. map/geo do nginx aiming for a file that fail2ban feeds — would you avoid reloading?
  3. Somehow do iptables/nftables add the header CF-Connecting-IP (I imagine it doesn’t, it’s L7, but probably).

Do you have any items in production with HestiaCP? Which one is more stable and requires less maintenance?

Valeu.

2

Well, I do not have your hestiacp+nginx configuration; I prefer to use apache+nginx in order to be able to install ModSecurity as an internal WAF inside Apache, apart from Cloudflare.

The thing is that using ModSecurity inside Apache allows you to read Cloudflare real IPs and block them without relying on fail2ban that acts at the iptables level.

I have not been able to install ModSecurity with the Nginx version that comes with HestiaCP; that also could help to do the same kind of protection, skipping the Apache installation.

About maintenance, well, ModSecurity can use OWASP rules, that could cause some troubles in some sites, so it won’t be easy at the begginning to set them correctly. But it allows also custom rules, that any IA could help you to create them based in the attacks that you detect in your web server logs.

My two cents (if it can help you in some way).