[bug]: When Sync Firewall rules enabled, fail2ban whitelist is not populated

[lgaetz]

FreePBX Version

FreePBX 17

Issue Description

Reproduced with firewall module ver. 17.0.1.30

With the firewall advanced setting “Intrusion Detection Sync Firewall” is set to enabled, the firewall module does not properly populate the ignoreip whitelist in fail2ban. THIS IS THE DEFAULT SETTING IN FPBX 17, so that means fail2ban whitelist is broken out of the box.

To reproduce
Confirm Firewall Advanced setting “Intrusion Detection Sync Firewall” is set to enabled
Browse to Firewall -> Networks tab and add IP/Subnets to trusted zone if not already there
Browse to Firewall -> Intrusion Detection tab and ensure that trusted zone is sync'd to fail2ban whitelist. Enable if necessary.

Now check /etc/fail2ban/jail.local in the default section, the ignoreip line will NOT be updated to include the trusted zone IPs

[DEFAULT]
ignoreip =  127.0.1.1 127.0.0.1 etc.

Now set the advanced setting “Intrusion Detection Sync Firewall” is set to legacy
Browse to the intrusion detection tab and add IPs to the whitelist field
When you check /etc/fail2ban/jail.local default section, you will now see the IPs correctly populated.

Operating Environment

FreePBX 17 on Debian 12 installed using Sangoma 17 install script.

Relevant log output

No response

[ramarajan222]

Hi @lgaetz ,

When sync is enabled, the ignored (trusted) IPs will be added using the CLI command (except for the interface IPs). You can confirm this using the Fail2Ban CLI command.

fail2ban-client get apache-api ignoreip

thanks

[lgaetz]

Hi Ram

While that bash command might be useful to some, it is not the fix for this issue. If an admin enables sync in the GUI, then fpbx MUST auto add the selected zone IPs/subnets to the fail2ban ignoreip list

[ramarajan222]

Hi @lgaetz, yes. It automatically adds the selected zone IPs to Fail2Ban. However, it does not write them to the configuration file, as they are added to Fail2Ban on the fly.

You can confirm this with the Fail2Ban CLI command to check whether they have been added or not.