Fail2ban for OpenConnect VPN Server (ocserv)

 pastikan OpenConnect VPN Server (ocserv) sudah berjalan dengan baik, di sini dengan debian 12,

1. enable log di ocserv

edit /etc/ocserv/ocserv.conf 

log-level = 1 

log-file = /var/log/ocserv/ocserv.log

jangan lupa restart

sudo systemctl restart ocserv 

2. jika log tidak muncul di  /var/log/ocserv/ocserv.log dan masih di syslog

nano /etc/rsyslog.d/30-ocserv.conf

isi
if $programname == 'ocserv' then /var/log/ocserv/ocserv.log
& stop

kemudian restart rsyslog
sudo systemctl restart rsyslog

cek log sudah ada dan normal berikut potongan log nya

2026-01-20T12:35:22.401936+07:00 debian ocserv[1048]: plain-auth: error authenticating user 'billy'
2026-01-20T12:35:22.402134+07:00 debian ocserv[1055]: ocserv[1055]: worker[billy]: 192.168.130.2 worker-auth.c:1724: failed authentication for 'billy'

 

3. buat filter untuk fail2ban

nano /etc/fail2ban/filter.d/ocserv.conf

isi

[Definition]
failregex = .*worker.*: <HOST> .* failed authentication for .*
ignoreregex =

 

4. Buat Jail Rule untuk Ocserv

Edit atau tambahkan file /etc/fail2ban/jail.local (jangan edit langsung jail.conf), dan tambahkan bagian ini:

isi

[ocserv]
enabled = true
port = 443
filter = ocserv
logpath = /var/log/ocserv/ocserv.log
maxretry = 3
findtime = 600
bantime = 3600
action = iptables-multiport[name=ocserv, port=443, protocol=tcp]

5. Restart Fail2ban

sudo systemctl restart fail2ban

 

6. test gagail login di  ocserv

 

7. Cek Status Jail

bash

tail /var/log/fail2ban.log

berikut potongan log nya

2026-01-20 12:36:05,884 fail2ban.server         [598]: INFO    Reload finished.
2026-01-20 12:36:05,897 fail2ban.filter            [598]: INFO    [ocserv] Found 192.168.130.2 - 2026-01-20 12:35:22
2026-01-20 12:36:05,897 fail2ban.filter            [598]: INFO    [ocserv] Found 192.168.130.2 - 2026-01-20 12:35:22
2026-01-20 12:37:18,026 fail2ban.filter            [598]: INFO    [ocserv] Found 192.168.130.2 - 2026-01-20 12:37:18
2026-01-20 12:37:18,026 fail2ban.filter            [598]: INFO    [ocserv] Found 192.168.130.2 - 2026-01-20 12:37:18
2026-01-20 12:37:18,475 fail2ban.actions       [598]: WARNING [ocserv] 192.168.130.2 already banned

 atau

sudo fail2ban-client status
sudo fail2ban-client status ocserv

semoga bermanfaat