# Integrating Fail2Ban with Pangolin: Guide 2025

**URL:** <https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485>\
**Category:** Networking\
**Tags:** fail2ban, pangolin\
**Created:** [February 13, 2025, 12:12pm UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485 "2025-02-13T12:12:28Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [February 13, 2025, 12:12pm UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/1 "2025-02-13T12:12:28Z")

</div>

# Integrating Fail2Ban with Pangolin

# USE ONLY AS LAST RESORT AND IF YOU KNOW WHAT YOU ARE DOING. ITS A PAIN TO MANAGE IT

# USE GEO-BLOCK and CROWDSEC MORE THAN ENOUGH

Fail2Ban is a powerful security tool that helps protect your Pangolin installation from brute force attacks and other malicious activities. This guide will walk you through integrating Fail2Ban with Pangolin using Traefik’s built-in Fail2Ban plugin.

## Installation and Configuration

### 1. Update Traefik Configuration

First, you’ll need to modify your Traefik configuration to include the Fail2Ban plugin. Open your `traefik_config.yml` and add the following under the experimental plugins section:

```yaml
experimental:
  plugins:
    badger:
      moduleName: "github.com/fosrl/badger"
      version: "v1.0.0-beta.3"
    fail2ban:
      moduleName: "github.com/tomMoulard/fail2ban"
      version: "v0.8.3"

```

### 2. Configure Fail2Ban Middleware

Add the Fail2Ban middleware configuration to your `dynamic_config.yml`:  
You will have to adjust according to your requirements.  
This is just a starter file to get you going.

```yaml
  middlewares:
    # fail2ban configuration with proper IP forwarding
    fail2ban:
      plugin:
        fail2ban:
          rules:
            bantime: 3h # Three hours is a good balance
            enabled: "true" # Must be string "true"
            findtime: 10m # Standard window for attempts
            maxretry: "4" # Four failures trigger ban
          whitelist:
            ip: ::1,127.0.0.1,100.89.137.0/20,172.16.0.0/12,10.0.0.0/8,192.168.0.0/16,your-ip/32 

```

This configuration:

- Whitelists internal network ranges
- Bans IPs for 1 hour after 5 failed attempts within 10 minutes
- Monitors both HTTP and HTTPS ports
- Watches for authentication failures (401/403 status codes)

### 3. Apply Middleware to traefik file

 ![image](https://forum-cdn.hhf.technology/original/1X/e0ff9d5c2bde40dff3b0dd0d8c14d7d0c404f7e1.png)

Update your http configurations in `traefik_config.yml` to use the Fail2Ban middleware. Add `fail2ban` to the middlewares list.

```yaml
    http:
      middlewares:
        - fail2ban@file # CHANGE MADE HERE (BOUNCER ENABLED) !!!
        - crowdsec@file
        - middlewares-compress@file
        - middlewares-secure-headers@file

```

### 4. Enable Access Logging

Ensure Traefik’s access logging is properly configured in `traefik_config.yml`:

```yaml
accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
  filters:
    statusCodes:
      - "200-299" # Success codes
      - "400-499" # Client errors
      - "500-599" # Server errors
    retryAttempts: true
    minDuration: "100ms" # Increased to focus on slower requests
  bufferingSize: 100 # Add buffering for better performance
  fields:
    defaultMode: drop # Start with dropping all fields
    names:
      ClientAddr: keep
      ClientHost: keep
      RequestMethod: keep
      RequestPath: keep
      RequestProtocol: keep
      DownstreamStatus: keep
      DownstreamContentSize: keep
      Duration: keep
      ServiceName: keep
      StartUTC: keep
      TLSVersion: keep
      TLSCipher: keep
      RetryAttempts: keep
    headers:
      defaultMode: drop
      names:
        User-Agent: keep
        X-Real-Ip: keep
        X-Forwarded-For: keep
        X-Forwarded-Proto: keep
        Content-Type: keep
        Authorization: redact # Redact sensitive information
        Cookie: redact # Redact sensitive information

```

 ![image](https://forum-cdn.hhf.technology/original/1X/218f4247fc3b26a38ec39e10c433dc6873e02c1c.png)

## Testing the Configuration

### Basic Functionality Test

1. **Generate Failed Login Attempts**

2. **Monitor Logs in Real-time**

### Testing Whitelist Configuration

1. **Test Internal Network Access**

2. **Test External IP Blocking**

### Verify Active Bans

Access Traefik’s API dashboard (if enabled in compose file):

 ![image](https://forum-cdn.hhf.technology/original/1X/61280d088511bbdf6adb5678abc0cef69fb30bc9.png)

```bash
curl http://172.19.0.3:8080/api/http/middlewares/fail2ban@file

```

## Managing IP Blocks

### How to Unblock an IP

There are several methods to unblock an IP address:

1. **Restart Traefik** (Quickest method)

2. **Wait for Ban Expiration**

### Best Practices

1. **Monitoring**

2. **Configuration Tuning**

3. **Maintenance**

## Troubleshooting

### Common Issues

1. **Bans Not Working**

2. **Legitimate Users Getting Banned**

3. **Configuration Not Taking Effect**

### Debug Mode

To enable more detailed logging, update the log level in `traefik_config.yml`:

```yaml
log:
  level: "DEBUG"

```

Remember to return it to “INFO” in production.

## Security Considerations

- Don’t set ban times too short (makes the protection ineffective)
- Don’t set retry attempts too high (makes the protection ineffective)
- Keep your whitelist minimal and regularly reviewed
- Monitor logs for signs of evasion attempts
- Consider implementing additional security measures like rate limiting

These configurations and practices will help secure your Pangolin installation against unauthorized access attempts while maintaining usability for legitimate users.

---

<div class="post-metadata">

**Author:** ![nwilliamsscu](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/e19b73/32.png) [@nwilliamsscu](https://forum.hhf.technology/u/nwilliamsscu)\
**Post date:** [March 5, 2025, 3:45am UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/2 "2025-03-05T03:45:06Z")

</div>

What if I have a dynamic IP? `your-ip/32` doesn’t seem to work long-term in a dynamic-ip scenario, right? Seems like I’ll be auto-banned every time my ip4 rotates?

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [March 5, 2025, 4:01am UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/3 "2025-03-05T04:01:09Z")

</div>

yes, you are right. fail2ban is more complicated. and it should be dployed on auth error only. false positive are really annoying

---

<div class="post-metadata">

**Author:** ![nwilliamsscu](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/e19b73/32.png) [@nwilliamsscu](https://forum.hhf.technology/u/nwilliamsscu)\
**Post date:** [March 5, 2025, 4:07am UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/4 "2025-03-05T04:07:39Z")

</div>

How would one go about deploying it “on auth error only”?

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [March 5, 2025, 4:20am UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/5 "2025-03-05T04:20:16Z")

</div>

there is small bug in pangolin. developer are looking at it.

 ![image](https://forum-cdn.hhf.technology/original/1X/0f94f69371f4963b55849bb9305e16ed6d277c37.png)  
 ![image](https://forum-cdn.hhf.technology/original/1X/818b9a040ae4ae33cef28fd3d333a795e446b9e9.png)

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [March 11, 2025, 8:38am UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/6 "2025-03-11T08:38:07Z")

</div>

Solved in the latest updated. pangolin 1.0.1

---

<div class="post-metadata">

**Author:** ![nwilliamsscu](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/n/e19b73/32.png) [@nwilliamsscu](https://forum.hhf.technology/u/nwilliamsscu)\
**Post date:** [March 11, 2025, 3:45pm UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/7 "2025-03-11T15:45:50Z")

</div>

2025/03/11 15:39:53 Plugin: FailToBan is up and running 🙌

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [March 11, 2025, 3:58pm UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/8 "2025-03-11T15:58:17Z")

</div>

Awesome. Have fun with the project.

---

<div class="post-metadata">

**Author:** ![hdsplus](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hdsplus/32/1548_2.png) [@hdsplus](https://forum.hhf.technology/u/hdsplus)\
**Post date:** [February 16, 2026, 8:58pm UTC](https://forum.hhf.technology/t/integrating-fail2ban-with-pangolin-guide-2025/485/9 "2026-02-16T20:58:56Z")

</div>

Hi,

Is it currently working for you? Fail2ban isn’t blocking anything.