jail.local.j2

#
# {{ansible_managed}}
#

[DEFAULT]
findtime = {{fail2ban_findtime}}
bantime  = {{fail2ban_bantime}}
maxretry = {{fail2ban_maxretry}}

# don't trust dns
usedns = no

# if f2b ever needs to send emails, send them to root and make sure the sender
# address clearly identifies the host the message originated from
destemail = root
sender = fail2ban@{{ansible_fqdn}}

# use firewalld to manage bans - if we don't specify this, then fail2ban will
# default to use iptables, which we don't want as our systems are running
# firewalld with nftables backend.
#
# check current rules added to firewalld while fail2ban is running:
#   firewall-cmd --direct --get-all-rules
# useful runtime commands include:
#   fail2ban-client set <JAIL> banip <IP>
#   fail2ban-cleint set <JAIL> unbanip <IP>
#   fail2ban-client set unban <IP>
#   fail2ban-client set unban --all
# see `fail2ban-client help` for full list of runtime commands
banaction = firewallcmd-ipset-allports

# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator.
ignoreip = 127.0.0.1/8 ::1
{% for host in groups['all'] %}
    {{ hostvars[host]['inventory_hostname'] }}
{% endfor %}