valknarandClaude Sonnet 5
00cc3583ec
statuscode "400,401,403-499" counted almost every client error as a brute-force strike, so normal 404s/400s from routine app behavior could rack up 5 hits in 10 minutes and trip a 3h ban (returned as 429) for real users. Narrow to 401/403 (actual auth failures) and raise maxretry to 15 so it still catches real brute-forcing without false-positiving on noise. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
16 lines
369 B
YAML
16 lines
369 B
YAML
http:
|
|
middlewares:
|
|
fail2ban:
|
|
plugin:
|
|
fail2ban:
|
|
allowlist:
|
|
ip: "127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1"
|
|
denylist:
|
|
ip: "74.7.243.196"
|
|
rules:
|
|
bantime: "3h"
|
|
findtime: "10m"
|
|
maxretry: 15
|
|
enabled: true
|
|
statuscode: "401,403"
|