--- title: 'Tutorial: Protect the Admin and Client Web UIs from Brute-Force Attacks with Fail2Ban' canonical: https://openvpn.net/as-docs/tutorials/tutorial--protect-web-uis-from-brute-force-attacks-with-fail2ban/ product: Access Server Docs description: How to install and configure Fail2Ban to protect Access Server's Admin and Client Web UIs from brute-force attacks. --- # Tutorial: Protect the Admin and Client Web UIs from Brute-Force Attacks with Fail2Ban ## Overview Fail2Ban is a security tool that protects servers from brute-force attacks by monitoring log files for suspicious activity, such as repeated failed login attempts, and blocking offending IP addresses. Access Server includes a built-in protection feature called the **Authentication Failure Lockout Policy**, which automatically triggers a lockout after a set number of failed login attempts within a defined timeframe. Using Fail2Ban in addition to this built-in feature provides an extra layer of defense, particularly against distributed or large-scale attacks targeting your Access Server web interfaces. This tutorial explains how to install and configure Fail2Ban to protect Access Server's Admin and Client Web UIs. ## Prerequisites - An installed Access Server. - Console access with the ability to get root privileges. ## Step 1: Install Fail2Ban 1. Connect to the console. 2. Run the appropriate command to install Fail2Ban on your Linux OS: - **For Ubuntu or Debian systems:** Update package repositories and install Fail2Ban: ``` sudo su apt update && apt install fail2ban -y ``` - **For Red Hat Enterprise Linux (RHEL) systems:** Install the EPEL (Extra Packages for Enterprise Linux) repository and Fail2Ban: ``` sudo su dnf install epel-release -y dnf install fail2ban -y ``` ## Step 2: Create a Fail2Ban filter **For Access Server versions 2.14.2 or 2.14.3** 1. Create the filter file: ``` nano /etc/fail2ban/filter.d/openvpnas.conf ``` 2. Add the following content: ``` [Definition] failregex = "" - - \[.*\] "GET /admin/\?login-failure=SW5jb3JyZWN0IGxvZ2luLg2 HTTP/1\.1" "" - - \[.*\] "POST /api/auth/login/userpassword HTTP/1\.1" (401|403) ignoreregex = ``` 3. Save and exit (**Ctrl+X**, then **Y**, and press **Enter**). **For Access Server version 2.14.1 or older** > **Important** > > These older versions don’t log the real source IP address for web interface logins. You must enable a debug flag to capture it, which significantly increases logging and disk usage. Use this method only as a last resort. [Upgrading](https://openvpn.net/as-docs/tutorials/tutorial--update-access-server.md) to a newer version is strongly recommended. 1. Edit the Access Server configuration file: ``` nano /usr/local/openvpn_as/etc/as.conf ``` 2. Add this debug flag: ``` DEBUG_LOGDB=1 ``` 3. Save and exit (**Ctrl+X**, then **Y**, and press **Enter**). 4. Restart the service: ``` systemctl restart openvpnas ``` 5. Create the Fail2Ban filter: ``` nano /etc/fail2ban/filter.d/openvpnas.conf ``` 6. Add the following content: ``` [Definition] failregex = ^.*LOG_DB RECORD.*"service": "WEB.*"real_ip": "".*"auth": 0 ignoreregex = ``` 7. Save and exit (**Ctrl+X**, then **Y**, and press **Enter**). ## Step 3: Configure the jail 1. Copy the default configuration from jail.conf into a new file called jail.local: ``` cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local ``` 2. Open the jail.local configuration file: ``` nano /etc/fail2ban/jail.local ``` 3. Look for the `[sshd]` jail and add the following: ``` enabled = false ``` - Example: ``` [sshd] # To use more aggressive sshd modes set filter parameter "mode" in jail.local: # normal (default), ddos, extra or aggressive (combines all). # See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details. #mode = normal port = ssh logpath = %(sshd_log)s backend = %(sshd_backend)s enabled = false ``` > **Tip** > > We recommend setting the `sshd` jail to false. It's enabled by default when installing Fail2Ban, but it isn't relevant to Access Server web services. Enabling this could potentially lock you out of SSH access. 4. Add the following configuration to the end of the file: ``` [openvpnas] enabled = true filter = openvpnas logpath = /var/log/openvpnas.log maxretry = 3 findtime = 600 bantime = 3600 action = iptables-multiport[name=OpenVPNAS, port="443,943", protocol=tcp] ``` **maxretry:** The number of failed attempts before banning. **findtime:** The time window (in seconds) to count failed attempts. **bantime:** The duration (in seconds) of the ban. These are the ports where Access Server's web interfaces are available. By default, they're TCP ports 943 and 443. 5. Save and exit (**Ctrl+X**, then **Y**, and press **Enter**). > **Note** > > When Access Server is configured to use more than one TCP daemon, it creates additional iptables port-forwarding rules in the `INPUT` chain. These rules are evaluated **before** the iptables rules created by Fail2Ban. > > As a result, a client that has been banned by Fail2Ban may still be able to access the Admin or Client Web UI (for example, over TCP 443), because the connection is internally redirected to daemon-specific ports before Fail2Ban can block it. > > For example, if two TCP daemons are configured: > > ``` > root@openvpnas:~# sacli ConfigQuery | grep daemon.tcp.n > "vpn.server.daemon.tcp.n_daemons": "2", > ``` > > Access Server adds rules similar to the following to the `INPUT` chain (output simplified): > > ``` > root@openvpnas:~# iptables -L INPUT -v -n > Chain INPUT (policy ACCEPT 645 packets, 34857 bytes) > pkts bytes target prot opt in out source destination > . > . > . > 3973 207K AS0_ACCEPT 6 -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:914 > 1782 93032 AS0_ACCEPT 6 -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:915 > ``` > > To ensure Fail2Ban correctly blocks access, include all relevant ports (including daemon-specific ports) in the jail action configuration. For example: > > ``` > action = iptables-multiport[name=OpenVPNAS, port="443,943,914,915", protocol=tcp] > ``` > > The port numbers and number of ports vary depending on how many TCP daemons are configured. Ensure you adjust the port list accordingly. ## (Optional) Exclude trusted IP addresses You can prevent specific IPs or networks from being banned using the `ignoreip` parameter. 1. Edit the jail configuration: ``` nano /etc/fail2ban/jail.local ``` 2. Add the `ignoreip` parameter under the `[openvpnas]` section: ``` ignoreip = 198.51.100.0/24 ``` Define a list of IP addresses, CIDR masks, or DNS hosts using space or comma separators. 3. Save and exit (**Ctrl+X**, then **Y**, and press **Enter**). ## Step 4: Restart Fail2Ban and verify the jail 1. Enable Fail2Ban to start on boot and restart to apply the configuration: ``` systemctl enable fail2ban systemctl restart fail2ban ``` 2. Verify the jail is active: ``` fail2ban-client status ``` - Example output: ``` root@Jose-F2B-AS:~# fail2ban-client status Status |- Number of jail: 2 `- Jail list: openvpnas, sshd ``` 3. To check a specific jail: ``` fail2ban-client status ``` - Example output: ``` root@Jose-F2B-AS:~# fail2ban-client status openvpnas Status for the jail: openvpnas |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/openvpnas.log `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: ``` ## (Optional) Unban an IP address If you accidentally block your own IP or a legitimate user, unban it with: ``` fail2ban-client set unbanip ``` ## (Optional) Verify Fail2Ban logs 1. You can review Fail2Ban logs for details on jail activity, bans, and matches: ``` cat /var/log/fail2ban.log ``` - Example output: ``` root@F2B-AS:~# cat /var/log/fail2ban.log 2025-07-24 03:00:15,532 fail2ban.server [127066]: INFO -------------------------------------------------- 2025-07-24 03:00:15,533 fail2ban.server [127066]: INFO Starting Fail2ban v1.0.2 2025-07-24 03:00:15,533 fail2ban.observer [127066]: INFO Observer start... 2025-07-24 03:00:15,540 fail2ban.database [127066]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3' 2025-07-24 03:00:15,541 fail2ban.jail [127066]: INFO Creating new jail 'openvpnas' 2025-07-24 03:00:15,652 fail2ban.jail [127066]: INFO Jail 'openvpnas' uses pyinotify {} 2025-07-24 03:00:15,655 fail2ban.jail [127066]: INFO Initiated 'pyinotify' backend 2025-07-24 03:00:15,656 fail2ban.filter [127066]: INFO maxRetry: 3 2025-07-24 03:00:15,656 fail2ban.filter [127066]: INFO findtime: 60 2025-07-24 03:00:15,656 fail2ban.actions [127066]: INFO banTime: 3600 2025-07-24 03:00:15,656 fail2ban.filter [127066]: INFO encoding: UTF-8 2025-07-24 03:00:15,657 fail2ban.filter [127066]: INFO Added logfile: '/var/log/openvpnas.log' (pos = 848561, hash = 4b51ab4c9af2b90b1b2952c50a6f2eb4b521d62d) 2025-07-24 03:00:15,658 fail2ban.jail [127066]: INFO Jail 'openvpnas' started 2025-07-24 03:00:52,391 fail2ban.filter [127066]: INFO [openvpnas] Found 192.168.1.254 - 2025-07-24 03:00:52 2025-07-24 03:00:53,994 fail2ban.filter [127066]: INFO [openvpnas] Found 192.168.1.254 - 2025-07-24 03:00:53 2025-07-24 03:00:54,776 fail2ban.filter [127066]: INFO [openvpnas] Found 192.168.1.254 - 2025-07-24 03:00:54 2025-07-24 03:00:54,876 fail2ban.actions [127066]: NOTICE [openvpnas] Ban 192.168.1.254 ``` 2. To confirm iptables entries created by Fail2Ban: ``` iptables-save -c | grep f2b-OpenVPNAS ``` - Example output: ``` root@Jose-F2B-AS:~# iptables-save -c | grep f2b-OpenVPNAS :f2b-OpenVPNAS - [0:0] [22:9108] -A INPUT -p tcp -m multiport --dports 443,943 -j f2b-OpenVPNAS [22:9108] -A f2b-OpenVPNAS -s 37.47.66.32/32 -j REJECT --reject-with icmp-port-unreachable [0:0] -A f2b-OpenVPNAS -j RETURN ``` --- Prev: [Tutorial: Configure the Authentication Failure Lockout Policy](https://openvpn.net/as-docs/tutorials/tutorial--authentication-failure-lockout-policy.md) Next: [Upgrades, Migrations, and Maintenance](https://openvpn.net/as-docs/tutorials/upgrades-migrations-and-maintenance.md) Index: https://openvpn.net/as-docs/llms.txt