At first wen need a Folder and get our Docker Compose File running

mkdir fail2ban
cd fail2ban
vi docker-compose.yml

Paste the following text into the editor:

version: "3"

services:
  fail2ban:
    container_name: fail2ban
    hostname: fail2ban
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      - TZ=Europe/Berlin
      - F2B_DB_PURGE_AGE=14d
      - SSMTP_HOST=<your-mail-server>
      - SSMTP_PORT=25
      - SSMTP_HOSTNAME=<hostname-of-your-container>
    image: crazymax/fail2ban:latest
    network_mode: host
    restart: unless-stopped
    volumes:
      - /root/fail2ban/data:/data
      - /root/ngix-proxy-manager/data/logs:/var/log/npm
      - /var/log:/var/log/varlog

Save the file and start the Container with

docker-compose up -d

The Fail2ban Container will be loaded and is starting. There should be a data dir now with 4 folders

action.d
db
filter.d
jail.d

The db Folder can be ignored, now we need to create a jail.local in jail.d

vi jail.d/jail.local

Paste the following in there.:

[DEFAULT]
# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32...
bantime.increment = true

# "bantime.rndtime" is the max number of seconds using for mixing with random time
# to prevent "clever" botnets calculate exact time IP can be unbanned again:
bantime.rndtime = 2048

# following example can be used for small initial ban time (bantime=60) - it grows more aggressive at begin,
# for bantime=60 the multipliers are minutes and equal: 1 min, 5 min, 30 min, 1 hour, 5 hour, 12 hour, 1 day, 2 day
bantime.multipliers = 1 5 30 60 300 720 1440 2880

#Ban without sending E-Mail
#action = %(action_)s

#Ban and send E-Mail
action = %(action_mw)s

destemail = <dest email>
sender = <from email>
mta = sendmail

[npm]
# bots that trigger too many 403 or 404
# logs are comming from reverse proxy "nginx proxy manager"
enabled = true
ignoreip = 127.0.0.0/8 10.0.0.0/8 172.0.0.0/8 192.168.0.0/16
filter = npm-filter
chain = DOCKER-USER
logpath = /var/log/npm/proxy-host-*_access.log
maxretry = 5
findtime = 60
bantime = 600

[sshd]

enabled = true
port    = ssh
filter  = sshd
ignoreip = 127.0.0.0/8 10.0.0.0/8 172.27.0.0/16 192.168.0.0/16
chain = INPUT
logpath = /var/log/varlog/auth.log
findtime = 10m
maxretry = 5
bantime = -1

we Monitor the NPM and the Systems sshd here, thats why we mapped the Volume from local logs into the fail2ban container.

Next Step is to add filter Rules in filter.d for our NPM

vi filter.d/npm-filter.conf

[INCLUDES]

[Definition]

failregex = ^.+ (405|404|403|401|\-) (405|404|403|401) - .+ [Client <HOST>] [Length .+] .+ [Sent-to <F-CONTAINER>.+</F-CONTAINER>] <F-USERAGENT>".+"</F-USERAGENT> .+$

ignoreregex = ^.+ (404|\-) (404) - .+".+(\.png|\.txt|\.jpg|\.ico|\.js|\.css)[/]" [Client <HOST>] [Length .+] ".+" .+$

Now we have everything set up and we can restart the container with

docker-compose restart

Now we want to see what fail2ban is doing. We can check the logs by doing docker ps to show the running containers and docker logs <container-id> --follow

Thats it, feel Free to ask if you have problems with this Setup