[RFE] Pre-ban IP reputation check — would a community action config be welcome?
First of all, thank you for maintaining fail2ban — it's been quietly protecting my servers (and millions of others) for years. I hope this is the right place for a feature discussion; if not, please point me to the correct channel.
The idea
fail2ban's current AbuseIPDB action (config/action.d/abuseipdb.conf) is reporting-oriented — it uploads what you've already banned. Several discussions here (#2401, #3801, and #4199 just now) hint at interest in the opposite direction: checking an IP's reputation before the ban decision, to reduce false positives on shared infrastructure (CDN edges, DNS resolvers, corporate NATs).
What I built
I'm the author of IP Radar, a self-hosted, AGPL-licensed tool that fuses 29 public threat intel feeds (blocklists, Tor/VPN/proxy ranges, CDN edges, GeoIP/ASN) into one verdict per IP, with a 0–100 confidence score. Everything runs locally in a single Docker container, so a pre-ban check is a localhost HTTP call — no rate limits, no per-query traffic leaving the machine.
To explore whether this is useful in practice, I wrote a fail2ban action config:
scripts/fail2ban/ipradar.conf— onactionban: confirmed-malicious IPs (confidence ≥ 70, tunable) get recorded to a persistent list; CDN/infra edges skip the ban with a log line; everything else proceeds as a normal fail2ban ban. If IP Radar is unreachable, the action no-ops and banning is unaffected.
The question
I'd genuinely appreciate your guidance on what shape this should take:
- Would a PR adding an
ipradar.conftoconfig/action.d/(alongside abuseipdb/ipthreat) be welcome? I understand if third-party actions add maintenance concerns — happy to keep it maintained and in sync with my API. - Or would you prefer this stays a community/third-party action, perhaps linked from the wiki?
Either answer is completely fine by me — I mainly want to do this the way that's best for the project, not just for mine. Thank you for your time!
Source: fail2ban/fail2ban