Nftables

On a Debian server with limited memory, I originally used CrowdSec to analyze SSH and web logs, then used Firewall Bouncer to synchronize ban decisions to nftables. This setup could dynamically ban IP addresses based on attack behavior. However, for a server with only a few hundred MiB of RAM running several personal services, its resource overhead needed to be reconsidered. I ultimately adopted the following combination: Website: Caddy GeoIP and a manual IP allowlist, with an option to exempt CDN-to-origin traffic on a per-site basis. SSH: Fail2ban reads the systemd journal and bans anomalous sources through nftables. This article documents the complete migration procedure, as well as the log-source and startup-ordering issues encountered during deployment. All domains, addresses, and host identifiers have been replaced with examples. Commands are run as the root user. ...

After deploying sing-box TUN on Armbian, I encountered a rather counterintuitive issue: IPv6 ping works, but IPv6 HTTPS connections time out after enabling auto_redirect. The eventual finding was that the problem was not with IPv6 public routing or the proxy node, but rather that the Linux loopback interface lo was missing the ::1/128 address. This article documents the diagnostic process and the fix. Environment Linux: Armbian, ARM64, 6.18-series kernel sing-box: 1.14.x Network management: Netplan + NetworkManager Transparent proxy: TUN, auto_route: true, auto_redirect: true IPv6: Automatically configured by the upstream; the interface already has a global IPv6 address and an RA default route To protect privacy, this article omits the actual public IP addresses, MAC addresses, router address, domain names, and custom internal routing table numbers. The ULA addresses and test targets in the following examples are for demonstration purposes. ...

When running UFW and sing-box TUN simultaneously on a Linux bypass router, an easily misdiagnosed failure may occur: sing-box runs normally on the local machine, but LAN devices cannot access the Internet through the bypass router. Even if the TCP port that was blocked at the time is allowed, the problem may reappear after sing-box is restarted. This article documents an actually observed cause and a fix pending regression validation. All examples use documentation-reserved addresses and do not correspond to a real network. ...

Automatically Banning Malicious IPs on a Debian Server with CrowdSec Public-facing servers face all kinds of automated scanning every single day. Even when you never advertise a service address, your SSH port still routinely receives login attempts against usernames like root, admin and test. Web services may get probed for paths such as .env, wp-admin and phpinfo.php. Most of these requests come from automated scanners. They may not amount to an actual intrusion, but they generate a huge amount of pointless log noise and widen the exposed attack surface. ...