🌴 Sync 2026-03-05 23:51:42

fail2banop/files/fail2banop.config

@@ -0,0 +1,5 @@
+config fail2banop
+    option enabled '1'
+    # option window '600'
+    # option threshold '10'
+    # option ban_duration '1440'

fail2banop/files/fail2banop.init

@@ -0,0 +1,41 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+USE_PROCD=1
+NAME=fail2banop
+ 
+get_config() {
+  config_get_bool enabled $1 enabled 0
+  config_get window $1 window 600
+  config_get threshold $1 threshold 10
+  config_get ban_duration $1 ban_duration 1440
+}
+
+start_service() { 
+  config_load "$NAME"
+  config_foreach get_config "$NAME"
+  [ $enabled != 1 ] && return 1
+
+  procd_open_instance
+  procd_set_param command /usr/sbin/fail2ban_op_bin \
+    --window="$window" \
+    --threshold="$threshold" \
+    --ban-duration="$ban_duration"
+  procd_set_param stderr 1
+  procd_set_param respawn
+  procd_close_instance
+}
+
+stop_service() {
+  nft flush set inet fw4 fail2banop4
+  nft flush set inet fw4 fail2banop6
+}
+
+service_triggers() {
+  procd_add_reload_trigger "$NAME"
+}
+
+
+reload_service() {
+	restart
+}

fail2banop/files/fail2banop.uci-default

@@ -0,0 +1,26 @@
+#!/bin/sh
+[ ! -f "/usr/share/ucitrack/luci-app-fail2banop.json" ] && {
+    cat > /usr/share/ucitrack/luci-app-fail2banop.json << EEOF
+{
+    "config": "fail2banop",
+    "init": "fail2banop"
+}
+EEOF
+}
+
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@fail2banop[-1]
+	add ucitrack fail2banop
+	set ucitrack.@fail2banop[-1].init=fail2banop
+	commit ucitrack
+EOF
+
+# Check if fail2ban chain exists in nftables, reload firewall if not
+if ! nft -t list chain inet fw4 input 2>/dev/null | grep -qF 'ip saddr @fail2banop4 drop'; then
+	/etc/init.d/firewall reload
+fi
+
+/etc/init.d/fail2banop enable
+
+exit 0
+

fail2banop/files/nft-hook/chain-pre/input/20-fail2banop.nft

@@ -0,0 +1,2 @@
+ip saddr @fail2banop4 drop
+ip6 saddr @fail2banop6 drop

fail2banop/files/nft-hook/table-post/21-fail2banop.nft

@@ -0,0 +1,2 @@
+set fail2banop4 { type ipv4_addr; }
+set fail2banop6 { type ipv6_addr; }