2025-07-11 A separate allow-list to bypass fail2ban

I automatically ban autonomous systems that host bots abusing my server. That's a pretty broad ban-hammer! I might OVH Hosting, for example. That is, the autonomous system number 16276 responsible for `139.99.128.0/17`. Somewhere in this network, however, there are servers that I do not want to ban, like the fedi instance Cathode Church at `139.99.194.127`. What to do?

ban autonomous systems

Cathode Church

I decided to create an allow-list and use it firewall rules before `fail2ban` gets to run. Let's hope that it works.

Of course, a list for IPv4 and a list for IPv6 is required.

The result is the following, with `ACCEPT` being controlled by `allowlist` coming before the `fail2ban` rules:

If you're wondering about `DROP` being controlled by `banlist`: That's the inverse of the allow-list, for permanent bans. The setup is similar:

Currently the ban-list is empty.

I used the ban-list for ban-cidr before switching to the dynamic `fail2ban` setup.

ban-cidr

Anyway, all this to say: If you're banned from one of my sites and you have a static IP number, contact me via email and I can put it on the allow-list.

​#Administration ​#Butlerian Jihad ​#iptables ​#ipset

**2025-07-27**. If one day the allow-list seems to have no effect, take a look:

Perhaps `fail2ban` inserted all its rules at the top? Determine the current place of the allow-list. Verify that you have the correct number and delete it. Then re-insert the rule at the beginning.

**2025-12-24**. And of course now I had to replace it all with `nft` stuff. 😭