fail2ban never bans a tunnel peer: ignoreip names the mesh range #113

2026-09-27T14:55:44Z

jschoubben commented

2026-09-27 14:55:44 +00:00

Adds ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} to the fail2ban jail.local [DEFAULT] — localhost plus the mesh's private range, named via the placeholder (paired with the mesh-controller ${machine:mesh-range} change) rather than hardcoded. Without it fail2ban could ban the mesh's own nodes; on novox that rule survived only in memory from a deleted HAL file and would be lost on the next restart.

Adds `ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}` to the fail2ban `jail.local` `[DEFAULT]` — localhost plus the mesh's private range, named via the placeholder (paired with the mesh-controller `${machine:mesh-range}` change) rather than hardcoded. Without it fail2ban could ban the mesh's own nodes; on novox that rule survived only in memory from a deleted HAL file and would be lost on the next restart.

jschoubben added 1 commit 2026-09-27 14:55:45 +00:00

fail2ban never bans a tunnel peer: ignoreip names the mesh range 278610c0c3

The jail.local [DEFAULT] gains ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}
— localhost plus the mesh's own private range, named through the placeholder
rather than hardcoded (data is the mesh's, ADR 0112). Without it fail2ban could
ban the mesh's own nodes on 10.10.0.0/24; on novox that rule survived only in
memory from a now-deleted HAL file and would be lost on the next restart.

jschoubben merged commit 3d7d896014 into main

2026-09-27 14:55:55 +00:00

jschoubben deleted branch fix/fail2ban-ignores-the-mesh-range

2026-09-27 14:55:55 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#113