Request Ministra fail2ban or firewall rule

[k3b]

Hello

I need some solution for ministra scanners. I have lot of bruteforce (proxy) mac address scanners and i want to block them. Maybe someone got fixet this with fail2ban? Or some firewall rule?


Here is the log from access_filter_error.log

93.87.74.202 - [Mon, 28 Dec 2020 02:31:32 +0100] country:RS, model:MAG250, mac:00:1A:79:4C:30E, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
120.236.254.175 - [Mon, 28 Dec 2020 02:31:33 +0100] country:CN, model:MAG250, mac:00:1A:79:62:3F:19, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
24.249.199.4 - [Mon, 28 Dec 2020 02:31:34 +0100] country:US, model:MAG250, mac:00:1A:79:48:FA:2B, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
98.162.25.7 - [Mon, 28 Dec 2020 02:31:34 +0100] country:US, model:MAG250, mac:00:1A:79:4C:30B, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
89.19.175.117 - [Mon, 28 Dec 2020 02:31:34 +0100] country:RU, model:MAG250, mac:00:1A:79:9A:B4:6C, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
113.106.9.248 - [Mon, 28 Dec 2020 02:31:34 +0100] country:CN, model:MAG250, mac:00:1A:79:9A:B4:65, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
186.204.82.66 - [Mon, 28 Dec 2020 02:31:34 +0100] country:BR, model:MAG250, mac:00:1A:79:62:3F:11, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
201.28.87.43 - [Mon, 28 Dec 2020 02:31:34 +0100] country:BR, model:MAG250, mac:00:1A:79:2E:07:35, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:
174.70.241.18 - [Mon, 28 Dec 2020 02:31:34 +0100] country:US, model:MAG250, mac:00:1A:79:5E:CD:2C, version:[ImageDescription: 0.2.18-r14-pub-250; PORTAL version: 5.5.0; API Version: JS API version: 328; STB API version: 134; Player Engine version: 0x566], referrer:

Thanks for help

 

[dexrax]

Use CF or some reverse proxy server.
F2B is can noy stop active conection