A Fail2Ban rule will not not trigger on often used method for scanning.

L.S.

This is a duplicate of issue https://issues.freepbx.org/browse/FREEPBX-11575

I reopend that one, but I realize that that issue is for another version of FreePBX (distro). So I am recreating the ticket for the current version.

The issue is that the rule:

^(%(__prefix_line)s|[]\s*)%(log_prefix)s Request from '[^']*' failed for '<HOST>:\d+' .+ No matching endpoint found$

Will never match any relevant lines since the request has type like 'OPTIONS' or 'INVITE' etc.

I would suggest that the following replacement broadly matches any (future) request type.

^(%(__prefix_line)s|[]\s*)%(log_prefix)s Request '.' from '[^']*' failed for '<HOST>:\d' .+ No matching endpoint found$

This is for fail2ban-fpbx-0.8.14-75.sng7.noarch

Kind regards, Arjen