I'm using Fail2ban with iptables-multiport on an OpenLiteSpeed server. After my IP is banned, a new browser session times out, but an already-open tab can still access the site.
Is this expected, and how can I make the ban take effect on existing connections too?
Check the firewall rule order first. If an established or related connection is accepted before traffic reaches the Fail2ban chain, an existing connection can keep passing while new connections get blocked.
Look at iptables -S and iptables -nvL, including the relevant chains and their jumps. If that's the issue, moving the Fail2ban jump ahead of the established connection accept rule can make the ban apply to packets on existing connections too.
You can also delete the banned IP's connection tracking entries as part of the ban action, using conntrack-tools. That is more targeted than flushing the whole connection tracking table.
For automation, the Fail2ban action would need to pass the banned IP to the deletion command. Test any custom action carefully and check both traffic directions and the ruleset, since deleting a tracking entry alone does not guarantee that subsequent packets will be dropped.
!toss+the~napkin:
Would that need to happen automatically for every ban? I don't want to delete entries by hand each time.
semi-formal-sandwich:
Yes, you could add it to a custom ban action. Make sure the action uses Fail2ban's banned-IP substitution rather than a literal placeholder, and test it before enabling it broadly.
An open tab isn't necessarily a separate session at the firewall level. The browser may be reusing an existing connection, while the new session opens another one. That difference points toward connection handling and firewall rules rather than an OpenLiteSpeed-specific setting.
Answers are reviewed before publication.
Marn:
Check the rule counters while testing as well. They can help show whether packets are reaching the ban chain or getting accepted earlier.