/etc/fail2ban/action.d/iptables-redirect.conf: After login failures, redirect to a different port. Handy for sending attackers to your honeypot

iptables-redirect.conf

# Fail2Ban configuration file
#
# Redirect from a certain port to a different port on the same host
# Example usage:
#	# By default redirects  port=22, toport=2222, protocol=tcp
#	action = iptables-redirect[name=cowrie]
#
#	# Can specify other defaults if you'd like.
# 	action = iptables-redirect[name=web, proto=tcp, port=80, toport=8080]


# Author: b9
# Based on: iptables-multiport
#	    by Cyril Jaquier, Yaroslav O. Halchenko <debian@onerussian.com>
# 
#

[INCLUDES]

before = iptables-common.conf


[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = <iptables> -t nat -N f2b-<name>
              <iptables> -t nat -A f2b-<name> -j <returntype>
              <iptables> -t nat -I PREROUTING -p <protocol> -j f2b-<name>

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop = <iptables> -t nat -D PREROUTING -p <protocol> -j f2b-<name>
             <iptables> -t nat -F f2b-<name>
             <iptables> -t nat -X f2b-<name>

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck = <iptables> -n -t nat -L PREROUTING | grep -q 'f2b-<name>[ \t]'

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = <iptables> -t nat -I f2b-<name> -p <protocol> --source <ip> --dport <port> -j REDIRECT --to-port <toport>

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban = <iptables> -t nat -D f2b-<name> -p <protocol> --source <ip> --dport <port> -j REDIRECT --to-port <toport>


[Init]

# Option:  protocol
# Notes.:  specifies the protocol needed for -j REDIRECT to work.
# Tags:    See man 8 iptables-extensions
# Values:  [ tcp | udp | dccp | sctp ]  Default: tcp
protocol = tcp

# Option:  port
# Notes.:  specifies port to redirect from
# Tags:    See man 8 iptables-extensions, particularly --dport under REDIRECT
# Values:  [ NUM | STRING ]  Default: ssh
port = 22

# Option:  toport
# Notes.:  specifies the port to redirect to
# Tags:    See man 8 iptables-extensions, particularly --to-port under REDIRECT
# Values:  [ tcp | udp | dccp | sctp ]  Default: 
toport = 2222