Comment on fail2ban behind reverse proxy (nom)
galacticworm@piefed.social 3 days ago
I have a similar setup to you, but I run caddy instead of npm. I recently added a log analyzer to caddy and noticed a bunch of hits I thought I could do something about..
I added a region based firewall rule for the port forward address on my UniFi gateway only allowing incoming traffic from my own country. I couldn’t do a global region block as I have some legitimate incoming traffic from the USA, so I went with a rule targeting traffic to the reverse proxy ip specifically. It still managed to let in some random bot traffic, so I also added a block region rule above the allow region rule (both to the reverse proxy) blocking countries like Russia, china, North Korea etc..
If you don’t need to allow most of the world, it is an easy fix to do this at your gateway (I note you have a udm)
nibbs@lemmy.zip 3 days ago
Thank you for suggesting the region block on Unifi, that’s a good tip.
I have that previously set in place globally under settings -> security -> protection -> region blocking.
So on a less sophisticated level and not as granular as you.
Yours seems to be much better and I will take a look at it later. At the moment I have way too many ideas and projects boiling, to add yet another one… ;)