Sample fail2ban configuration to protect an unbound DNS resolver.

Installation

# Copy the filter
cp unbound.conf /etc/fail2ban/filter.d/unbound.conf

# Copy (or merge) the jail config
cp jail.local /etc/fail2ban/jail.local

# Restart fail2ban
systemctl restart fail2ban

How it works

The filter (unbound.conf) matches unbound query-log lines via fail2ban's <HOST> tag. The jail (jail.local) bans IPs that exceed the retry threshold using iptables on UDP port 53.

Notes

• jail.local assumes unbound logs to /var/log/daemon.log. On systemd-based systems, you may need backend = systemd instead.
• Defaults: maxretry = 5, bantime = 600, findtime = 10. Adjust as needed.
• Email alerts via sendmail-whois are commented out — uncomment to enable.

License

BSD-2-Clause. See LICENSE.