https://blog.margrop.net/en/tag/nftables/ Recent content in Nftables on Margrop Blog Hugo -- gohugo.io en-US Sat, 30 May 2026 15:45:00 +0800 https://blog.margrop.net/en/post/reverse-ssh-fail2ban-vpn-gateway-investigation/ Sat, 30 May 2026 15:45:00 +0800 https://blog.margrop.net/en/post/reverse-ssh-fail2ban-vpn-gateway-investigation/ <blockquote> <p><strong>Bottom line</strong></p> <p>The symptom looked simple: I could SSH from the local machine into a remote internal host, but the reverse SSH path failed when the remote host tried to connect back. <code>sshd</code> was listening, the route table looked fine, and the failure still happened.</p> <p>The real root cause was not a broken SSH daemon. <code>Fail2Ban</code> had banned the <strong>VPN gateway address</strong> that represented the return path. From the local machine&rsquo;s point of view, the incoming SSH session did not appear to come directly from the remote host. It appeared to come from the gateway, so the ban cut off the whole reverse path.</p> </blockquote> https://blog.margrop.net/en/post/ubuntu-2604-pve-92-fail2ban-nftables-guide/ Tue, 26 May 2026 22:20:00 +0800 https://blog.margrop.net/en/post/ubuntu-2604-pve-92-fail2ban-nftables-guide/ <blockquote> <p><strong>The Bottom Line</strong></p> <p>With the releases of Ubuntu 26.04 LTS and Proxmox VE (PVE) 9.2, many system administrators, DevOps engineers, and self-hosting enthusiasts have eagerly upgraded or clean-installed these latest systems. However, during the post-installation security hardening phase, you may encounter a highly frustrating scenario: <strong>simply copying over your legacy Fail2Ban configuration files from older versions (such as Ubuntu 20.04/22.04 or PVE 7.x/8.x) will either cause the Fail2Ban service to crash during startup or, worse, run silently in the background while completely failing to block external brute-force attacks!</strong></p> <p>This issue is not caused by a bug in Fail2Ban itself. Instead, it is the result of three &ldquo;invisible bombs&rdquo; hidden beneath the surface of these modern Linux distributions, namely changes in the logging architecture, service activation mechanisms, and firewall backends. This article provides an in-depth analysis of these three architectural shifts and introduces a modern, bulletproof Fail2Ban configuration guide fully integrated with <code>systemd-journald</code> and <code>nftables</code>.</p> </blockquote>