How can I verify if a ban rule is in effect for a specific jail ?

Initiate win2ban-shell at the root of the installation directory and issue the command below (example jail win2ban-network-logon):

$ fail2ban-client status win2ban-network-logon

Status for the jail: win2ban-network-logon

|- Filter

| |- Currently failed: 1

| |- Total failed: 5

| `- File list: /winlogbeat/logs/eventlog

`- Actions

|- Currently banned: 1

|- Total banned: 2

`- Banned IP list: 192.168.100.22

The related firewall rule(s) can be displayed by using the following Powershell command:

get-netfirewallrule -all | Where-Object {$_.DisplayName -like "win2ban*"} | Format-Table

Name DisplayName DisplayGroup Enabled Profile Direction Action

---- ----------- ------------ ------- ------- --------- ------

{F9BAA4EB-D8A8-48C7-9205-D3246D70F990} win2ban - ban 192.168.100.22 True Any Inbound Block

Release news