How to use curl to add packet filter rules (via Fail2ban)

First, you need to create a network object of type Host.

Next you need to find the "REF_xxxx" for this object

Now you can create the rule and use that object as the "source".

... only theory

I spend a lot of time with the rest API browser to create the host object, but I could not assign that object to a group.

Thanks Dirk.

I think I'll contact support - I can see this being a big sink hole for my time! Given how popular fail2ban and Sophos UTM are, I was hoping that someone had managed to get the two to work together!

James.

James, if you get this working, please post instructions here.  You might want to read We hit 100,000 IP's blocked last night from a spam botnet.

Cheers - Bob

James, if you get this working, please post instructions here.  You might want to read We hit 100,000 IP's blocked last night from a spam botnet.

Cheers - Bob

Hi Bob. I've made some progress on this. Tech Support said that first you need to use the API to create the Host (ie the IP you want to block). Then you use the API to create the packet filter (firewall) rule, referencing that host.

Reading the section 5 of the documentation I found the Swagger interface - just go to  https://ip_address_of_ UTM:4444/api/ and you can find all that the API can do. It is fantastic. This is how I was able to create the Network Host object in the UTM.

I created a firewall rule in the UTM's web GUI with Source being a Network Group that I'd created. The idea is that after I've created the Network Host using the API, I'd use the API to tell put it in the Network Group.

This way I'd just have one Firewall Rule.

Unfortunately I've spent all afternoon looking, but I can't see anyway to add a Network Host to a Network Group using the API.

So that's what I'm stuck on at the moment.

James.

Well, finally got it to work! After spending all day with much trial & error, I worked out the syntax. Basically, the Swagger UI lies about what you can do with POST, PUT & PATCH commands. You can write to all the fields, not just the 'comment' and 'name' fields.

So, to add the Host with reference "REF_NetHos1918811671 (IP of 191.101.167.14) to the Network Group with ref "REF_NetGroBanneIpsFail2" I used:

% curl -X PATCH --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Basic SmZXCvbnNMJHxMjM=' -d '{"comment":"Test","name":"","members":["REF_NetHos1911011671"]}' 'my.sophos.utm.address:4445/.../REF_NetGroBanneIpsFail2' 

and output returned was:

{

  "_locked": "",

  "_ref": "REF_NetGroBanneIpsFail2",

  "_type": "network/group",

  "comment": "Test",

  "members": [

    "REF_NetHos1911011671"

  ],

  "name": "191.101.167.14",

  "types": [

    "host"

  ]

}%    

So very relieved to get that working.

Now my issue is that this curl command will overwrite what is already there. Ie if the Network Group already has a few Hosts as members they will be removed with this curl command - its only member would be 191.101.167.14