Using nextdns.io as parental control for home user

This summary is not available. Please click here to view the post.

Debian 13: part 2 configure privoxy and torrc as lan https gateway to anonymity Tor Network

Prerequisite Debian 13: part 1 install Tor-Project  without error.

General network configuration 

Internet — router —- lan —- proxy(tor) 

All client has direct connection to internet via router. Client's browser can be configure to use proxy tor for anonymity.

The browser's connection becomes: [Client PC] --> [Debian Server - Tor & Privoxy] --> (WAN/Router) --> Internet (via Tor)

Privoxy is your https proxy. privoxy will connect to tor software, and tor software will find the way to reach destination using tor anonymity network. 

Debian proxy

Install privoxy

# apt-get install privoxy

Edit or add your /etc/privoxy/config : 

# listening port for your lan
listen-address  0.0.0.0:8118
# connection to tor software, privoxy and torrc run on the same server/pc
forward-socks5t / 127.0.0.1:9050

Edit or add your /etc/tor/torrc :

# Change "myNiceRelay" to something you like
Nickname    myNiceRelay
# Write your e-mail and be aware it will be published
ContactInfo your@e-mail
# for relay, 0 disable
ORPort      0
# for exit relay, 0 disable
ExitRelay   0
# use 127.0.0.1 to make torrc only accessible by localhost / privoxy
# comment these if you allow lan accessing torrc
SocksPort 9050
SocksListenAddress 127.0.0.1
# uncomment these to allow lan accessing torrc
#SocksBindAddress 192.168.1.1:9050
#SocksPolicy accept 192.168.1.0/24
#SocksPolicy reject *

 Enable your privoxy and tor service 

# systemctl enable tor
# systemctl enable privoxy
# systemctl restart tor
# systemctl restart privoxy

Client Browser

Open your browser setting, find proxy. Fill with

HTTP Proxy: 192.168.1.10
Port: 8118 

Note: change 192.168.1.10 to your debian lan ip server.

Now your client can browsing using anonymity tor network

Debian 13: part 1 install Tor-Project

Tor Project's repository only support amd64, arm64, or i386 architectures.

# dpkg --print-architecture
amd64

Install apt-transport-https

# apt install apt-transport-https gnupg

Add Tor Project repository into debian machince

1. Create a new file in /etc/apt/sources.list.d/ named tor.list
2. Filled /etc/apt/sources.list.d/tor.list with:
   deb     [signed-by=/usr/share/keyrings/deb.torproject.org-keyring.gpg] https://deb.torproject.org/torproject.org trixiemain
deb-src [signed-by=/usr/share/keyrings/deb.torproject.org-keyring.gpg] https://deb.torproject.org/torproject.org trixie main

Currently, Tor repository only support bookworm, bullseye and trixie.

Add gpg key for Tor Project's repository 

# wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null

If asc file does not exist, use your browser to open https://deb.torproject.org/torproject.org/. It will open directory of /torproject.org. Find file's name with asc, copy the file name and replace A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc with the new one. 

Install Tor Project key's

# apt install tor deb.torproject.org-keyring

Installing Tor

# apt install tor

 

Debian 13: general nftables with set for web server and router

This is general nftables for apache, ssh, dns ntp 

#!/usr/sbin/nft -f

flush ruleset

table inet filter {

    # Set for common inbound web server ports

    set web_ports {

        type inet_service;

        flags interval;

        elements = { 80, 443 }

    }

    # Set for other essential services, like SSH, DNS, and NTP

    set services {

        type inet_service;

        elements = { 22, 53, 123 }

    }

    chain input {

        type filter hook input priority 0; policy drop;

        # Allow connections that are part of an existing or related session

        ct state established,related accept

        # Drop invalid packets

        ct state invalid drop

        # Allow traffic from the loopback interface

        iif "lo" accept

        # Allow incoming traffic for common web services

        tcp dport @web_ports accept

        # Allow incoming SSH, DNS, and NTP traffic

        tcp dport @services accept

        udp dport @services accept

        # Allow incoming ICMP (ping) packets for diagnostics

        icmp type echo-request accept

        # Log and drop any other incoming traffic

        meta protocol vmap { ip : log prefix "[NFT-DROP]: ", ip6 : log prefix "[NFT-DROP]: " }

        meta protocol vmap { ip : drop, ip6 : drop }

    }

    chain forward {

        type filter hook forward priority 0; policy drop;

    }

    chain output {

        type filter hook output priority 0; policy accept;

    }

}

This is nftable for general router

• eth0 to internet/router
• eth1 to lan 

Edit/create nano /etc/sysctl.conf

net.ipv4.ip_forward=1

nftables rules

#!/usr/sbin/nft -f

# Clear all existing rules

flush ruleset

# --- Define variables for interfaces and networks ---

define wan_if = eth0

define lan_if = eth1

define lan_net = 192.168.1.0/24

# === Table for IPv4/IPv6 filtering ===

table inet filter {

    # Set for essential services (SSH, DNS, NTP)

    set essential_services {

        type inet_service;

        elements = { 22, 53, 123 }

    }

    # Set for web server ports

    set web_ports {

        type inet_service;

        flags interval;

        elements = { 80, 443 }

    }

    # Set of trusted interfaces (LAN)

    set trusted_interfaces {

        type ifname;

        elements = { $lan_if }

    }

    # Set of untrusted interfaces (WAN)

    set untrusted_interfaces {

        type ifname;

        elements = { $wan_if }

    }

    # --- INPUT chain: Controls traffic destined for the router itself ---

    chain input {

        type filter hook input priority 0; policy drop;

        # Accept packets that are part of an established or related connection

        ct state established,related accept

        # Drop any packets with an invalid connection state

        ct state invalid drop

        # Allow traffic from the loopback interface

        iif "lo" accept

        # Allow all traffic from the trusted LAN interfaces

        iifname @trusted_interfaces accept

        # Allow incoming SSH, DNS, and NTP from the internet (rate limited)

        iifname @untrusted_interfaces tcp dport @essential_services limit rate 10/minute accept

        iifname @untrusted_interfaces udp dport @essential_services limit rate 10/minute accept

        # Allow incoming web traffic (Apache) from the internet

        iifname @untrusted_interfaces tcp dport @web_ports accept

        # Allow ICMP (ping) from the internet, but rate-limit it

        iifname @untrusted_interfaces icmp type echo-request limit rate 5/second accept

        # Log and drop everything else coming from untrusted interfaces

        iifname @untrusted_interfaces log prefix "NFT-INET-DROP: "

        iifname @untrusted_interfaces drop

        # Catch-all log and drop for other incoming traffic

        log prefix "NFT-INPUT-DROP: "

        drop

    }

    # --- FORWARD chain: Controls traffic passing *through* the router ---

    chain forward {

        type filter hook forward priority 0; policy drop;

        # Accept packets that are part of an established or related connection

        ct state established,related accept

        # Drop invalid packets

        ct state invalid drop

        # Allow outbound traffic from the LAN to the internet

        iifname @trusted_interfaces oifname @untrusted_interfaces accept

        # Log and drop any other forwarded traffic

        log prefix "NFT-FORWARD-DROP: "

        drop

    }

    # --- OUTPUT chain: Controls traffic originating from the server ---

    chain output {

        type filter hook output priority 0; policy accept;

    }

}

# === NAT table for IPv4 (needed for internet access from LAN) ===

table ip nat {

    # --- PREROUTING chain: Used for incoming traffic before routing ---

    chain prerouting {

        type nat hook prerouting priority 0;

        # Example: Port forward incoming web traffic from the internet to a specific LAN machine

        # iifname $wan_if tcp dport { 80, 443 } dnat to 192.168.1.100

    }

    # --- POSTROUTING chain: Used for outgoing traffic after routing ---

    chain postrouting {

        type nat hook postrouting priority 100;

        # Masquerade traffic leaving the internet interface

        oifname $wan_if masquerade

    }

}

Unix like OS not base on linux

Linux is a very popular open-source Unix-like operating system. Open-source Unix-like operating systems that are not based on Linux and are still actively developed. They are

1. FreeBSD
   Focus: Performance, advanced networking, storage
   Use Cases: Servers, firewalls, storage appliances (e.g., TrueNAS)
2. OpenBSD
   Focus: Security, correctness, simplicity
   Known for: Secure-by-default policies, clean codebase
3. NetBSD
   Focus: Portability — runs on almost any architecture
   Use Cases: Embedded systems, research, legacy hardware
4. DragonFly BSD
   Focus: Performance, advanced file system (HAMMER2), scalability
5. illumos
   Descendant of: OpenSolaris (which was derived from UNIX System V)
6. OpenIndiana
   Goal: Desktop/server OS based on illumos
7. SmartOS
   Focus: Cloud-native virtualization with zones, ZFS, DTrace
8. MidnightBSD
   Fork of FreeBSD, focused on desktop use
9. Darwin
   Apple's open-source core of macOS (not a complete OS itself)
   Basis for macOS and iOS

Most those operating system are intended to run as server connected directly to internet with advance stability and security. 

Removing bloatware in Android

It is common, every non AOSP android may come with ton of partner's application. The applications are known as bloatware.

Some bloatwares can be uninstall. Or some can only be disable. However, bloatware with disable can still running on background.  

Those bloatwares are used your mobile phone resource. These are steps to remove/uninstall from your mobile using PC, any operation system that can run adb (Android Debugging Bridge). I Assume, you done this.

You must enable development mode and USB Debugging your mobile phone.

Development mode	USB Debugging

Afteer you connect your mobile phone to your PC using USB, from your mobile, you need to trust your PC to make connection and run debugging, include running script via adb.

AllowUSB Debugging

Open your terminal and go to directory where your ADB tool install or placed, e.q. D:\android\sdk\platform-tools. Follow this command

1. detect your android phone

>adb devices
List of devices attached
1xxxxxxxxxxxxxxx        device

2. connect to your device

>adb shell
TECNO-KJ6:/ $

3. run pm to remove bloatware

$ pm uninstall --user 0 com.transsnet.store
Success

4. exit

$ exit
>

To View packages

$ pm list packages | grep store
package:com.google.android.apps.restore
package:com.transsnet.store

This is screen shoot status of application after deletion.

Getting package name

After removing/deletion

You need to know the package name you want to remove. Pick any application you wish in play store with key search "Application Inspector"

Bloatware Table

Application	Package Name	Tecno Spark 20 Pro KJ6	Infinix note 12 x670
AHA Games	net.bat.store	n	y
Folax	com.transsion.aivoiceassistant	n	y
Hola Browser	com.talpa.hibrowser	y	y
Palm Store	com.transsnet.store	y	y
Visha Player	com.transsion.magicshow	n	y
WeZone	com.transsion.wezone	n	y

NOTE:

1. The bloatware status uninstall after restart your android
2. The bloatware still exist in rom, every time you reset your android, the bloatware will come up. You need to re do all steps to remove it.

Reference: https://www.phoneworld.com.pk/the-truth-about-xos-how-infinixs-ui-is-burdened-by-excessive-bloatware/

 

Recovering from hacked account is so painful when we accidently got scammed.

Recovering from a hacked account is so painful when we accidently get scammed. 

To recover hacked gmail, do it as fast as possible. Even if a hacker changes your phone recovery and or your email recovery, Google still keeps your previous recovery data for some time (maybe 7 days). I called it the grace period.

In my case, i successfully recovered my gmail less than 12 hours after the account was hacked. After successfully signing in into your account, go to https://myaccount.google.com, immediately check your devices, and sign off of any unknown device. 

Then, in security, check recovery options. Remove any unwanted recovery option. Add your original recovery phone number and recovery email if necessary. Verify them as soon as possible. 

These processes are race conditions with hackers.

If a hacker changes your email account for Mobile Legends: Bang Bang and email account Clash of Clans, you will lose them. No one of those games provides good support for recovery.

Openssl s_client to verify SSL

Syntax general: openssl s_client [-connect host:port] [option]

 

Get and read openssl s_client output 

$ echo "Get HTTP/1.0" | openssl s_client google.com:443
CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1                        <- verification chain 2 ok
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1                        <- verification chain 1 ok
depth=0 CN = *.google.com
verify return:1                        <- verification chain 0 ok
---
Certificate chain
 0 s:CN = *.google.com
   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan  9 06:25:08 2024 GMT; NotAfter: Apr  2 06:25:07 2024 GMT
 1 s:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Aug 13 00:00:42 2020 GMT; NotAfter: Sep 30 00:00:42 2027 GMT
 2 s:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jun 19 00:00:42 2020 GMT; NotAfter: Jan 28 00:00:42 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
... <TRUNCATED> ...
-----END CERTIFICATE-----
subject=CN = *.google.com
issuer=C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 6833 bytes and written 396 bytes
Verification: OK                    <- handshake verification ok
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

Use openssl s_client to export certificate PEM into a file (output file: certfs.pem)

$ echo "Get HTTP/1.0" | openssl s_client -showcerts -connect google.com:443 </dev/null | sed -n -e '/-.BEGIN/,/-.END/ p' > certifs.pem
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = *.google.com
verify return:1
DONE

Get fingerprint SHA1 in byte

$ echo "Get HTTP/1.0" | openssl s_client -connect google.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin

Fingerprint SHA256 in byte

$ echo "Get HTTP/1.0" | openssl s_client -connect google.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin

Fingerprint SHA256 in base64 encode

$ echo "Get HTTP/1.0" | openssl s_client -connect google.com:443 | \
    openssl x509 -pubkey -noout | \
    openssl rsa -pubin -outform der | \
    openssl dgst -sha256 -binary | \
    openssl enc -base64 

To get service sertificates

$ echo "Get HTTP/1.0" | openssl s_client -connect google.com.com:443 -showcerts

For Let's Encrypt, here is official information about compatibility platforms (operating system, browser and java virtual machine,  <https://letsencrypt.org/docs/certificate-compatibility/>

Reference:

• https://www.openssl.org/docs/man1.0.2/man1/openssl-s_client.html
• https://www.baeldung.com/linux/ssl-certificates
  

huawei echolife default user for EG & HG series

There are 3 default type/user group available in echolife EG, HG and DSL Home Gateway series, these user name and password are:

type/user group	EG Series	HG V300R016C10 and earlier	HG V300R017C00 and later	DSL Home Gateway
user	Epuser/userEp	root/admin	root/adminHW	user/HuaweiUser
admin	Epadmin/adminEp	root/admin *	root/adminHW *	user/HuaweiUser *
telnet	Eproot/adminEp	root/admin *	root/adminHW *	user/HuaweiUser *

* not tested

if those fail try telecomadmin/admintelecom or admin/@HuaweiHgw or maybe your firmware has been customized by your privder

1. user: for general use
2. admin: for more setting then user e.q to change default ntp and time zone; change services
   
3. telnet: for connect to router via telnet or SSH

In EG8145V5 default service to access your router are:

1. Enable the LAN-side PC to access the device using HTTP
2. Enable devices on the Wi-Fi side to access web pages

Important: 

1. Change default password immediately and put in a note
2. DO NOT OPEN ANY SERVICES for WAN

References: https://forum.huawei.com/enterprise/en/huawei-ont-login-account-and-password/thread/667238610795118592-667213871523442688

Detecting DNS flood using dns-flood-detector

You need to install dns-flood-detector
# apt-get install dns-flood-detector

dns-flood-detector will give you warning in dmesg something like:
[1309426.142779] TCP: request_sock_TCP: Possible SYN flooding on port 53. Sending cookies.  Check SNMP counters.

To show where it is come from

# /etc/init<dot>d/dns-flood-detector status
* dns-flood-detector<dot>service - LSB: start and stop the dns-flood-detector daemon
   Loaded: loaded (/etc/init<dot>d/dns-flood-detector; generated; vendor preset: enabled)
   Active: active (running) since Fri 2018-01-05 14:25:46 WIB; 2 weeks 1 days ago
     Docs: man:systemd-sysv-generator(8)
    Tasks: 2 (limit: 4915)
   CGroup: /system<dot>slice/dns-flood-detector<dot>service
           `-475 /usr/bin/dns-flood-detector -d -v -v -t5 -w3
Jan 20 18:09:20 mars dns_flood_detector[475]: source [66<dot>220<dot>156<dot>144] - 3 tc…AA]
Jan 20 18:09:23 mars dns_flood_detector[475]: source [173<dot>252<dot>90<dot>118] - 3 tc…AA]
Warning: Journal has been rotated since unit was started<dot> Log output is incomplete or unavailable<dot>
Hint: Some lines were ellipsized, use -l to show in full<dot>




or

# service dns-flood-detector status
* dns-flood-detector<dot>service - LSB: start and stop the dns-flood-dete
ctor daemon
   Loaded: loaded (/etc/init<dot>d/dns-flood-detector; generated; vendor preset: ena
bled)
   Active: active (running) since Fri 2018-01-05 14:25:46 WIB; 2 week
s 1 days ago
     Docs: man:systemd-sysv-generator(8)
    Tasks: 2 (limit: 4915)
   CGroup: /system<dot>slice/dns-flood-detector<dot>service
           `-475 /usr/bin/dns-flood-detector -d -v -v -t5 -w3
Jan 20 18:09:20 mars dns_flood_detector[475]: source [66<dot>220<dot>156<dot>144] -
3 tcp qps : 3 udp qps [1 qps A] [5 qps AAAA]
Jan 20 18:09:23 mars dns_flood_detector[475]: source [173<dot>252<dot>90<dot>118] -
3 tcp qps : 3 udp qps [1 qps A] [5 qps AAAA]
Warning: Journal has been rotated since unit was started<dot> Log output is incomple
te or unavailable<dot>




Lets we find out who they are


# whois 66<dot>220<dot>156<dot>144
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www<dot>arin<dot>net/whois_tou<dot>html
#
# If you see inaccuracies in the results, please report at
# https://www<dot>arin<dot>net/public/whoisinaccuracy/index<dot>xhtml
#
#
# The following results may also be obtained via:
# https://whois<dot>arin<dot>net/rest/nets;q=66<dot>220<dot>156<dot>144?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#
NetRange:       66<dot>220<dot>144<dot>0 - 66<dot>220<dot>159<dot>255
CIDR:           66<dot>220<dot>144<dot>0/20
NetName:        TFBNET3
NetHandle:      NET-66-220-144-0-1
Parent:         NET66 (NET-66-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       AS32934
Organization:   Facebook, Inc<dot> (THEFA-3)
RegDate:        2009-02-13
Updated:        2012-02-24
Ref:            https://whois<dot>arin<dot>net/rest/net/NET-66-220-144-0-1
...

and


# whois 173<dot>252<dot>90<dot>118
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www<dot>arin<dot>net/whois_tou<dot>html
#
# If you see inaccuracies in the results, please report at
# https://www<dot>arin<dot>net/public/whoisinaccuracy/index<dot>xhtml
#
#
# The following results may also be obtained via:
# https://whois<dot>arin<dot>net/rest/nets;q=173<dot>252<dot>90<dot>118?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#
NetRange:       173<dot>252<dot>64<dot>0 - 173<dot>252<dot>127<dot>255
CIDR:           173<dot>252<dot>64<dot>0/18
NetName:        FACEBOOK-INC
NetHandle:      NET-173-252-64-0-1
Parent:         NET173 (NET-173-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       AS32934
Organization:   Facebook, Inc<dot> (THEFA-3)
RegDate:        2011-02-28
Updated:        2012-02-24
Ref:            https://whois<dot>arin<dot>net/rest/net/NET-173-252-64-0-1


Ops they are Facebook.inc :D

Lets we block it
# ipset add mynetrules 66<dot>220<dot>156<dot>144
# ipset add mynetrules 173<dot>252<dot>90<dot>118
# iptables -L | grep mynetrules
DROP       all  --  anywhere             anywhere             match-set mynetrules src

These are how to block class C
Jan 21 10:11:31 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>119] - 3 t…AA]
Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>125] - 3 t…AA]
Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>126] - 3 t…AA]
Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>123] - 3 t…AA]

Jan 21 10:11:34 mars dns_flood_detector[475]: source [173<dot>252<dot>124<dot>124] - 3 t…AA]
Just check one of them
# whois 173<dot>252<dot>124<dot>124
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www<dot>arin<dot>net/whois_tou<dot>html
#
# If you see inaccuracies in the results, please report at
# https://www<dot>arin<dot>net/public/whoisinaccuracy/index<dot>xhtml
#
#
# The following results may also be obtained via:
# https://whois<dot>arin<dot>net/rest/nets;q=173<dot>252<dot>124<dot>124?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#
NetRange:       173<dot>252<dot>64<dot>0 - 173<dot>252<dot>127<dot>255
CIDR:           173<dot>252<dot>64<dot>0/18
NetName:        FACEBOOK-INC
NetHandle:      NET-173-252-64-0-1
Parent:         NET173 (NET-173-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       AS32934
Organization:   Facebook, Inc<dot> (THEFA-3)
RegDate:        2011-02-28
Updated:        2012-02-24
Ref:            https://whois<dot>arin<dot>net/rest/net/NET-173-252-64-0-1


Lets we block it
# ipset add mynetrules 173<dot>252<dot>124<dot>0/24

Blocking IP by country for some ports using ipset

To block IP by country, we need IP blocks for particular country. This step needs IP blocks from http://ipdeny.com/.
We need to convert IP blocks into ipset format, this bash script will do:

1. Download block ip by country from http://www.ipdeny.com
2. Convert block ip into ipset format

For IPV4: http://www.ipdeny.com/ipblocks/data/countries/ For IPV6: http://www.ipdeny.com/ipv6/ipaddresses/blocks/
Here is bash script blockcountryip.sh:

#!/bin/bash
# 2017-05-23

if [ "$1" != "" ]; then
 echo $1
 # download ipv4 block
 echo "Download ipv4 $1"
 wget http://www.ipdeny.com/ipblocks/data/countries/$1.zone -O zone.ipv4.$1
 # download ipv6 block
 echo "Download ipv6 $1"
 wget http://www.ipdeny.com/ipv6/ipaddresses/blocks/$1.zone -O zone.ipv6.$1
 mfile1="./zone.ipv4.$1"
 ofile1="./ipv4.ipset.$1"
 touch $ofile1
 echo "creating ipset rules $ofile1 for ipv4"
 echo "create ipv4_$1 hash:net" > $ofile1
 while read line; do
  echo "add ipv4_$1 $line" >> $ofile1
 done <"$mfile1"
 echo "Done creating $ofile1"
 mfile2="./zone.ipv6.$1"
 ofile2="./ipv6.ipset.$1"
 echo "creating ipset rules $ofile2 for ipv6"
 echo "create ipv6_$1 hash:net" > $ofile2
 while read line; do
  echo "add ipv6_$1 $line" >> $ofile2
 done <"$mfile2"
 echo "Done creating $ofile2"
else
 echo "Usage .//blockcountryip.sh countrycode2"
fi

To use this bash script:

# ./blockcountryip.sh [countrycode]

for example to generate IP blocks for China CN

# ./blockcountryip.sh cn

To load it in memory

# ipset restore -! < ipv4.ipset.[countrycode]

[countrycode] is 2 character country code https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
To apply in iptables

# iptables -A INPUT -p tcp -m multiport --dports [any port you wish] -m set --match-set ipv4_[countrycode] src -j DROP

For example to block all IPV4 from China for port 21, 22, 80, 443 and 2222

# iptables -A INPUT -p tcp -m multiport --dports 21,22,80,443,2222 -m set --match-set ipv4_cn src -j DROP 
# iptables -A INPUT -p udp -m multiport --dports 22,2222 -m set --match-set ipv4_cn src -j DROP

Who will care if I block all of their connection:

# iptables -A INPUT -m set --match-set ipv4_cn src -j DROP

To make it persistent, follow your distribution guide how to load ipset and iptables rules every time system start/restart or network start/restart.
Not Working IPV6
Note:

1. Tunneling SSH may used UDP protocol
2. Proftpd listen on port 2222
3. Port 25 uses to communicate with/to other mail server

My github.com: https://github.com/dedetok/bash-block-ip-by-country
 References:

• http://ipdeny.com/ 
• https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2

Fail2ban: save your log into mysql and show it

Required:

• fail2ban 0.9
• mysql
• web server with php (apache with php and mysql library)

Create user and its database in mysql. Give all privilege to its database for its user. You can use any existing database, here is only sample of database structures:
database name : myf2b
table name: kci_logipv4

No	field	datatype
1	logdate	datetime
2	logipv4	int(11)
3	logmsg	varchar(1000)
4	kci_category	int(11)
5	id	(int11)
6	codecontinent	char(2)
7	codecontinent2	char(2)
8	codecontinent3	char(3)

table name: kci_category

No	field	datatype
1	id	int(11)
2	category	varchar(20)

Note:

1. We store IPv4 in long.
2. Field with underline is primary key 

Table kci_logipv4 will be used to store any log from trapped in fail2ban, and table kci_category will be used to categorize all log in type of attack. Populate kci_category with your wish, this is my category for example: 

id	category
10	SSH
20	FTP
30	HTTP/HTTPS
40	SMTP/POP/IMAP/POP3/S

We need a small application to store any log trapped in fail2ban. I use PHP to do that. Here is kci_log.php source code https://github.com/dedetok/fail2ban-to-mysql/blob/gh-pages/kci_log.php
That's all. Now you create a custom action mlocaldb.conf for fail2ban to call kci_log.php. Put mlocaldb.conf in /etc/fail2ban/action.d/, here is mlocaldb.conf https://github.com/dedetok/fail2ban-to-mysql/blob/gh-pages/mlocaldb.conf
Note: You need to change this part 'http://[your_domain]/kci_log.php' >> /home/[user]/logs/curlfail2ban.log

• 'http://[your_domain]/kci_log.php' where kci_log.php reside
• /home/[user]/logs/curlfail2ban.log where the log will be store. You can remove it after you confidence.

The final step, edit your /etc/fail2ban/jail.conf and add a line to use mlocaldb at the end of action, for example:

...
[sshd]

port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
enabled = true
filter = sshd
action = iptables-ipset-proto4[name=sshd]
        mlocaldb[category=10]
        abuseipdb[category=4,18,22] 

...
Note change category with id you inserted into table kci_category. For example 20 for proftpd.
Show it in your web. This is kci_logread.php source code to show the log, feel free to modify it . https://github.com/dedetok/fail2ban-to-mysql/blob/gh-pages/kci_logread.php

See on Github https://github.com/dedetok/fail2ban-to-mysql

Script Kiddies to use hydra

 This is intended for Education purpose!
After researching how to defend our network, I want to share how to perform what they are doing. It is very easy to perform automatic password attack against various services. One of their tools is hydra. Chrome mark https://www.thc.org/ "The site ahead contains harmful programs" and Firefox mark it as "Reported Unwanted Software Page!". Who's care.... LOL
To install it
# apt-get install hydra
or
# yum install hydra
To create dictionary install British words
# apt-get install wbritish
or

# yum install words
You don't need to run this as root.
Create a directory (whatever you want). I use directory hydra.
$ mkdir hydra
$ cd hydra
Now create words file before running hydra.
$ cat /usr/share/dict/words > words.txt
You can perform ssh using
hydra -l root -P words.txt ssh://xxx.xxx.xxx.xxx
To get more option:
$ hydra -h
Hydra v8.0 (c) 2014 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes.

Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-SuvVd46] [service://server[:PORT][/OPT]]

Options:
  -R        restore a previous aborted/crashed session
  -S        perform an SSL connect
  -s PORT   if the service is on a different default port, define it here
  -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
  -p PASS  or -P FILE  try password PASS, or load several passwords from FILE
  -x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
  -e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
  -u        loop around users, not passwords (effective! implied with -x)
  -C FILE   colon separated "login:pass" format, instead of -L/-P options
  -M FILE   list of servers to attack, one entry per line, ':' to specify port
  -o FILE   write found login/password pairs to FILE instead of stdout
  -f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
  -t TASKS  run TASKS number of connects in parallel (per host, default: 16)
  -w / -W TIME  waittime for responses (32s) / between connects per thread
  -4 / -6   prefer IPv4 (default) or IPv6 addresses
  -v / -V / -d  verbose mode / show login+pass for each attempt / debug mode
  -q        do not print messages about connection erros
  -U        service module usage details
  server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
  service   the service to crack (see below for supported protocols)
  OPT       some service modules support additional input (-U for module help)

Supported services: asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head|get} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres rdp redis rexec rlogin rsh s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp

Hydra is a tool to guess/crack valid login/password pairs. Licensed under AGPL
v3.0. The newest version is always available at http://www.thc.org/thc-hydra
Don't use in military or secret service organizations, or for illegal purposes.
These services were not compiled in: sapr3 afp ncp oracle.

Use HYDRA_PROXY_HTTP or HYDRA_PROXY - and if needed HYDRA_PROXY_AUTH - environment for a proxy setup.
E.g.:  % export HYDRA_PROXY=socks5://127.0.0.1:9150 (or socks4:// or connect://)
       % export HYDRA_PROXY_HTTP=http://proxy:8080
       % export HYDRA_PROXY_AUTH=user:pass

Examples:
  hydra -l user -P passlist.txt ftp://192.168.0.1
  hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN
  hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
  hydra -l admin -p password ftp://[192.168.0.0/24]/
  hydra -L logins.txt -P pws.txt -M targets.txt ssh
WARNING: FOR EDUCATION PURPOSE! DO IT ON YOUR LOCAL NETWORK AND WITH YOUR OWN RISK. DOING THIS IS ON PUBLIC NETWORK IS BREAKING A LAW!

fail2ban: autoreporting attack to www.abuseipdb.com

Create file /etc/fail2ban/action.d/abuseipdb.conf
# Fail2Ban configuration file
#
# Author: IGAM Muliarsa
#
#

# Action to report IP address to abuseipdb.com
# you must sign up in https://www.abuseipdb.com
# This action requires API_KEY
# https://www.abuseipdb.com/report/json?key=[API_KEY]&category=[CATEGORIES]&comment=[COMMENT]&ip=[IP]
#
# IMPORTANT:
#
# Reporting an IP of abuse is a serious complaint. Make sure that it is
# serious. Fail2ban developers and network owners recommend you only use this
# action for:
#   * The recidive where the IP has been banned multiple times
#   * Where maxretry has been set quite high, beyond the normal user typing
#     password incorrectly.
#   * For filters that have a low likelyhood of receiving human errors
#

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop =

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = curl --data 'key=<apikey>' --data 'category=<category>' --data 'ip=<ip>' --data-urlencode 'comment=<matches>' --user-agent 'fail2ban v0.8.12' 'https://www.abuseipdb.com/report/json'

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban =

[Init]

# Option:  apikey
# Notes    your user apikey from abuseipdb.com user account
# Values:  STRING  Default: None
#
apikey = REPLACE_WITH_YOUR_API_KEY

# Option:  service
# Notes    service name you are reporting on, typically aligns with filter name
# Values:  STRING  Default: None
#
#service =
Edit /etc/fail2ban/jail.conf
...
[sshd]

port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
enabled = true
filter = sshd
action = iptables-ipset-proto4[]
        mlocaldb[category=10]
        abuseipdb[category=4,18,22]
...
To find available category, follow this rule.
Restart your fail2ban.
Tested on Fail2ban 0.9.x

References:

• https://www.abuseipdb.com/api.html

China DDOS SSH 2016-10-11 Involving 12 IPs

Log:
Oct 10 21:18:22 mars sshd[11737]: Bad protocol version identification 'test' from 183.129.160.229 port 50149
Oct 10 21:32:00 mars sshd[14650]: Received disconnect from 124.232.156.78: 11: Bye Bye [preauth]
Oct 11 01:28:56 mars sshd[29033]: fatal: no matching cipher found: client aes128-cbc,blowfish-cbc,3des-cbc server aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com [preauth]
Oct 11 03:05:36 mars sshd[16159]: Did not receive identification string from 113.108.21.16
Oct 11 04:40:43 mars sshd[2440]: Received disconnect from 121.18.238.114: 11:  [preauth]
Oct 11 04:43:11 mars sshd[2477]: Received disconnect from 119.249.54.75: 11:  [preauth]
Oct 11 04:44:12 mars sshd[2482]: Received disconnect from 221.194.47.208: 11:  [preauth]
Oct 11 04:45:11 mars sshd[2886]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 04:45:45 mars sshd[3419]: Received disconnect from 221.194.47.224: 11:  [preauth]
Oct 11 04:52:32 mars sshd[4427]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 04:53:53 mars sshd[4433]: Received disconnect from 121.18.238.98: 11:  [preauth]
Oct 11 04:56:15 mars sshd[5350]: Received disconnect from 119.249.54.68: 11:  [preauth]
Oct 11 04:57:21 mars sshd[5384]: Received disconnect from 221.194.47.208: 11:  [preauth]
Oct 11 04:57:52 mars sshd[5387]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 04:58:10 mars sshd[5390]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 05:02:36 mars sshd[6364]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 05:08:11 mars sshd[7341]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 05:09:53 mars sshd[7399]: Received disconnect from 119.249.54.68: 11:  [preauth]
Oct 11 05:16:53 mars sshd[9285]: Received disconnect from 121.18.238.109: 11:  [preauth]
Oct 11 05:18:51 mars sshd[9323]: Received disconnect from 119.249.54.75: 11:  [preauth]
Oct 11 05:18:54 mars sshd[9325]: Received disconnect from 121.18.238.114: 11:  [preauth]
Oct 11 05:25:45 mars sshd[11293]: Received disconnect from 221.194.47.224: 11:  [preauth]
Oct 11 05:26:41 mars sshd[11297]: Received disconnect from 119.249.54.66: 11:  [preauth]
Oct 11 05:29:04 mars sshd[11335]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 05:30:10 mars sshd[11717]: Received disconnect from 119.249.54.66: 11:  [preauth]
Oct 11 05:31:35 mars sshd[12252]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 05:37:35 mars sshd[13232]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 05:40:48 mars sshd[14251]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 05:47:08 mars sshd[15236]: Received disconnect from 119.249.54.88: 11:  [preauth]
Oct 11 05:51:46 mars sshd[16208]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 05:54:15 mars sshd[16266]: Received disconnect from 119.249.54.88: 11:  [preauth]
Oct 11 05:57:01 mars sshd[17206]: Received disconnect from 121.18.238.98: 11:  [preauth]
Oct 11 06:13:24 mars sshd[20155]: Connection closed by 221.194.47.208 [preauth]
Oct 11 06:16:53 mars sshd[21101]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 06:34:57 mars sshd[24362]: Received disconnect from 121.18.238.114: 11:  [preauth]
Oct 11 06:40:53 mars sshd[26291]: Received disconnect from 119.249.54.68: 11:  [preauth]
Oct 11 06:41:43 mars sshd[26296]: Received disconnect from 119.249.54.75: 11:  [preauth]
Oct 11 06:41:58 mars sshd[26299]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 06:50:14 mars sshd[27709]: Received disconnect from 121.18.238.98: 11:  [preauth]
Oct 11 07:55:39 mars sshd[8437]: Received disconnect from 119.249.54.88: 11:  [preauth]
Oct 11 08:01:33 mars sshd[9618]: Received disconnect from 221.194.47.208: 11:  [preauth]
Oct 11 08:03:14 mars sshd[9627]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 08:04:00 mars sshd[9632]: Received disconnect from 119.249.54.75: 11:  [preauth]
Oct 10 21:18:22 mars sshd[11737]: Bad protocol version identification 'test' from 183.129.160.229 port 50149
Oct 10 21:32:00 mars sshd[14650]: Received disconnect from 124.232.156.78: 11: Bye Bye [preauth]
Oct 11 01:28:56 mars sshd[29033]: fatal: no matching cipher found: client aes128-cbc,blowfish-cbc,3des-cbc server aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com [preauth]
Oct 11 03:05:36 mars sshd[16159]: Did not receive identification string from 113.108.21.16
Oct 11 04:40:43 mars sshd[2440]: Received disconnect from 121.18.238.114: 11:  [preauth]
Oct 11 04:43:11 mars sshd[2477]: Received disconnect from 119.249.54.75: 11:  [preauth]
Oct 11 04:44:12 mars sshd[2482]: Received disconnect from 221.194.47.208: 11:  [preauth]
Oct 11 04:45:11 mars sshd[2886]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 04:45:45 mars sshd[3419]: Received disconnect from 221.194.47.224: 11:  [preauth]
Oct 11 04:52:32 mars sshd[4427]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 04:53:53 mars sshd[4433]: Received disconnect from 121.18.238.98: 11:  [preauth]
Oct 11 04:56:15 mars sshd[5350]: Received disconnect from 119.249.54.68: 11:  [preauth]
Oct 11 04:57:21 mars sshd[5384]: Received disconnect from 221.194.47.208: 11:  [preauth]
Oct 11 04:57:52 mars sshd[5387]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 04:58:10 mars sshd[5390]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 05:02:36 mars sshd[6364]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 05:08:11 mars sshd[7341]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 05:09:53 mars sshd[7399]: Received disconnect from 119.249.54.68: 11:  [preauth]
Oct 11 05:16:53 mars sshd[9285]: Received disconnect from 121.18.238.109: 11:  [preauth]
Oct 11 05:18:51 mars sshd[9323]: Received disconnect from 119.249.54.75: 11:  [preauth]
Oct 11 05:18:54 mars sshd[9325]: Received disconnect from 121.18.238.114: 11:  [preauth]
Oct 11 05:25:45 mars sshd[11293]: Received disconnect from 221.194.47.224: 11:  [preauth]
Oct 11 05:26:41 mars sshd[11297]: Received disconnect from 119.249.54.66: 11:  [preauth]
Oct 11 05:29:04 mars sshd[11335]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 05:30:10 mars sshd[11717]: Received disconnect from 119.249.54.66: 11:  [preauth]
Oct 11 05:31:35 mars sshd[12252]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 05:37:35 mars sshd[13232]: Received disconnect from 221.194.47.229: 11:  [preauth]
Oct 11 05:40:48 mars sshd[14251]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 05:47:08 mars sshd[15236]: Received disconnect from 119.249.54.88: 11:  [preauth]
Oct 11 05:51:46 mars sshd[16208]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 05:54:15 mars sshd[16266]: Received disconnect from 119.249.54.88: 11:  [preauth]
Oct 11 05:57:01 mars sshd[17206]: Received disconnect from 121.18.238.98: 11:  [preauth]
Oct 11 06:13:24 mars sshd[20155]: Connection closed by 221.194.47.208 [preauth]
Oct 11 06:16:53 mars sshd[21101]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 06:34:57 mars sshd[24362]: Received disconnect from 121.18.238.114: 11:  [preauth]
Oct 11 06:40:53 mars sshd[26291]: Received disconnect from 119.249.54.68: 11:  [preauth]
Oct 11 06:41:43 mars sshd[26296]: Received disconnect from 119.249.54.75: 11:  [preauth]
Oct 11 06:41:58 mars sshd[26299]: Received disconnect from 221.194.47.249: 11:  [preauth]
Oct 11 06:50:14 mars sshd[27709]: Received disconnect from 121.18.238.98: 11:  [preauth]
Oct 11 07:55:39 mars sshd[8437]: Received disconnect from 119.249.54.88: 11:  [preauth]
Oct 11 08:01:33 mars sshd[9618]: Received disconnect from 221.194.47.208: 11:  [preauth]
Oct 11 08:03:14 mars sshd[9627]: Received disconnect from 121.18.238.104: 11:  [preauth]
Oct 11 08:04:00 mars sshd[9632]: Received disconnect from 119.249.54.75: 11:  [preauth]
Here is attacker IPs:

1. 119.249.54.66
2. 119.249.54.68
3. 119.249.54.75
4. 119.249.54.88
5. 121.18.238.104
6. 121.18.238.109
7. 121.18.238.114
8. 121.18.238.98
9. 221.194.47.208
10. 221.194.47.224
11. 221.194.47.229
12. 221.194.47.249

 Others IPs before attact begin:

1. 113.108.21.16
   Oct 11 03:05:36    mars sshd[16159]:    Did not receive identification string from    113.108.21.16   
2. 124.232.156.78
   Oct 10 21:32:00    mars sshd[14650]:    Received disconnect from    124.232.156.78    :  11: Bye Bye [preauth]
3. 183.129.160.229
   Oct 11 03:05:36    mars sshd[16159]:    Did not receive identification string from    113.108.21.16   

Sequence for each IP attempt:

No	Time	From	Method Auth	No	Time	From	Method Auth
1	2016-10-11 4:40	121.18.238.114	:  11:  [preauth]	21	2016-10-11 5:30	119.249.54.66	:  11:  [preauth]
2	2016-10-11 4:43	119.249.54.75	:  11:  [preauth]	22	2016-10-11 5:31	121.18.238.104	:  11:  [preauth]
3	2016-10-11 4:44	221.194.47.208	:  11:  [preauth]	23	2016-10-11 5:37	221.194.47.229	:  11:  [preauth]
4	2016-10-11 4:45	221.194.47.229	:  11:  [preauth]	24	2016-10-11 5:40	121.18.238.104	:  11:  [preauth]
5	2016-10-11 4:45	221.194.47.224	:  11:  [preauth]	25	2016-10-11 5:47	119.249.54.88	:  11:  [preauth]
6	2016-10-11 4:52	221.194.47.249	:  11:  [preauth]	26	2016-10-11 5:51	121.18.238.104	:  11:  [preauth]
7	2016-10-11 4:53	121.18.238.98	:  11:  [preauth]	27	2016-10-11 5:54	119.249.54.88	:  11:  [preauth]
8	2016-10-11 4:56	119.249.54.68	:  11:  [preauth]	28	2016-10-11 5:57	121.18.238.98	:  11:  [preauth]
9	2016-10-11 4:57	221.194.47.208	:  11:  [preauth]	29	2016-10-11 6:13	221.194.47.208	[preauth]
10	2016-10-11 4:57	121.18.238.104	:  11:  [preauth]	30	2016-10-11 6:16	121.18.238.104	:  11:  [preauth]
11	2016-10-11 4:58	221.194.47.229	:  11:  [preauth]	31	2016-10-11 6:34	121.18.238.114	:  11:  [preauth]
12	2016-10-11 5:02	221.194.47.249	:  11:  [preauth]	32	2016-10-11 6:40	119.249.54.68	:  11:  [preauth]
13	2016-10-11 5:08	221.194.47.249	:  11:  [preauth]	33	2016-10-11 6:41	119.249.54.75	:  11:  [preauth]
14	2016-10-11 5:09	119.249.54.68	:  11:  [preauth]	34	2016-10-11 6:41	221.194.47.249	:  11:  [preauth]
15	2016-10-11 5:16	121.18.238.109	:  11:  [preauth]	35	2016-10-11 6:50	121.18.238.98	:  11:  [preauth]
16	2016-10-11 5:18	119.249.54.75	:  11:  [preauth]	36	2016-10-11 7:55	119.249.54.88	:  11:  [preauth]
17	2016-10-11 5:18	121.18.238.114	:  11:  [preauth]	37	2016-10-11 8:01	221.194.47.208	:  11:  [preauth]
18	2016-10-11 5:25	221.194.47.224	:  11:  [preauth]	38	2016-10-11 8:03	121.18.238.104	:  11:  [preauth]
19	2016-10-11 5:26	119.249.54.66	:  11:  [preauth]	39	2016-10-11 8:04	119.249.54.75	:  11:  [preauth]
20	2016-10-11 5:29	221.194.47.229	:  11:  [preauth]

 It is better to block those IP in block /24:
For iptables:
# iptables -A INPUT -p tcp -m tcp --dport 22 -s 119.249.54.0/24 -j DROP
# iptables -A INPUT -p tcp -m tcp --dport 22 -s 121.18.238.0/24 -j DROP
# iptables -A INPUT -p tcp -m tcp --dport 22 -s 221.194.47.0/24 -j DROP
If you don't have business with them  just block all incoming connection from them:
# iptables -A INPUT -s 119.249.54.0/24 -j DROP
# iptables -A INPUT -s 121.18.238.0/24 -j DROP
# iptables -A INPUT s 221.194.47.0/24 -j DROP

Debian Jessie: installing fail2ban 0.9.5-1 from SID with ipset

Debian Jessie stable contain old version of fail2ban, i.e. fail2Ban v0.8.13 (Debian 8.6). This version has reach end of life cycle from its developer. Current version (in active) development is version 0.10. Debian Jessie in SID (unstable) has version 0.9.5-1. We are going to use this version on our production server.
Our /etc/apt/sources.list, we don't add any SID repository to our sources.

deb http://kambing.ui.ac.id/debian/ jessie main

deb-src http://kambing.ui.ac.id/debian/ jessie main

deb http://security.debian.org/ jessie/updates main
deb-src http://security.debian.org/ jessie/updates main

#backport
deb http://ftp.debian.org/debian jessie-backports main

Before download and install fail2ban, install all required package. 

Download fail2ban 0.9.5-1 installer from SID directly from main pool

http://ftp.us.debian.org/debian/pool/main/f/fail2ban/fail2ban_0.9.5-1_all.deb

or from its mirror (choose your closest one)

http://kambing.ui.ac.id/debian/pool/main/f/fail2ban/fail2ban_0.9.5-1_all.deb

Use wget to retrieve fail2ban 0.9.5-1 installer

# wget http://kambing.ui.ac.id/debian/pool/main/f/fail2ban/fail2ban_0.9.5-1_all.deb

If you are not confidence to use "unstable" version use fail2ban 0.9.3-1 from testing

http://ftp.us.debian.org/debian/pool/main/f/fail2ban/fail2ban_0.9.3-1_all.deb

Remove existing fail2ban

# apt-get --purge remove fail2ban

You can now start to install fail2ban 0.9.5-1

# dpkg -i fail2ban_0.9.5-1_all.deb
(Reading database ... 109167 files and directories currently installed.)
Preparing to unpack fail2ban_0.9.5-1_all.deb ...
Unpacking fail2ban (0.9.5-1) over (0.9.5-1) ...
dpkg: dependency problems prevent configuration of fail2ban:
 fail2ban depends on python3:any (>= 3.3.2-2~).
dpkg: error processing package fail2ban (--install):
 dependency problems - leaving unconfigured
Processing triggers for systemd (215-17+deb8u5) ...
Processing triggers for man-db (2.7.0.2-5) ...
Errors were encountered while processing:
 fail2ban

It will ask you to install python python3. It's file and safe, your default python still 2.7. Run this command to fix it.

# apt-get -f install
...
# python --version
Python 2.7.9

Create a new action in /etc/fail2ban/action.d/iptables-ipset-proto4-allports.conf

# Fail2Ban configuration file
# Original: iptables-ipset-proto4.conf (Author: Daniel Black)
# Modified: IGAM Muliarsa
#
# Tested on: Debian 8.6
# ipset version: ipset v6.23, protocol version: 6
[INCLUDES]
before = iptables-common.conf
[Definition]
# Option: actionstart
# Notes.: command executed once at the start of Fail2Ban.
# Values: CMD
#
actionstart = ipset --create f2b- iphash
-I -m set --match-set f2b- src -j
# Option: actionstop
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD
#
actionstop = -D -m set --match-set f2b- src -j
ipset --flush f2b-
ipset --destroy f2b-
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
actionban = ipset --test f2b- || ipset --add f2b-
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
actionunban = ipset --test f2b- && ipset --del f2b-
[Init]
You need to enable configure /etc/fail2ban/fail.conf and enabling ipset
...
# consider low maxretry and a long bantime
bantime = 600
...
maxretry = 5
...
[sshd]

port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
enabled = true
filter = sshd
action = iptables-ipset-proto4[name=sshd]
...
[sshd-ddos]
# This jail corresponds to the standard configuration in Fail2ban.
# The mail-whois action send a notification e-mail with a whois request
# in the body.
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
enabled = true
filter = sshd
action = iptables-ipset-proto4[name=sshd-dos]
...
[proftpd]
port = ftp,ftp-data,ftps,ftps-data
logpath = %(proftpd_log)s
backend = %(proftpd_backend)s
enabled = true
filter = proftpd
action = iptables-ipset-proto4-allports[name=proftpd]
...
[postfix]

port = smtp,465,submission
logpath = %(postfix_log)s
backend = %(postfix_backend)s
enabled = true
filter = postfix
action = iptables-ipset-proto4[name=postfix, port="25,465,993,995,465,143,110"]
...
[postfix-sasl]

port = smtp,465,submission,imap3,imaps,pop3,pop3s
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath = %(postfix_log)s
backend = %(postfix_backend)s
enabled = true
filter = postfix-sasl
action = iptables-ipset-proto4[name=postfix-sasl, port="25,465,993,995,465,143,110"]
...
[dovecot]

port = pop3,pop3s,imap,imaps,submission,465,sieve
logpath = %(dovecot_log)s
backend = %(dovecot_backend)s
enabled = true
filter = dovecot
action = iptables-ipset-proto4[name=dovecot, port="25,465,993,995,465,143,110"]
...

Note: you need to define name in iptables-ipset-proto4[] to make it work properly
after Restart your fail2ban

# /etc/init.d/fail2ban restart
...
# /etc/init.d/fail2ban status
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled)
Active: active (running) since Thu 2016-10-06 12:10:29 WIB; 4min 24s ago
Docs: man:fail2ban(1)
Process: 24350 ExecStop=/usr/bin/fail2ban-client stop (code=exited, status=0/SUCCESS)
Process: 24358 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=0/SUCCESS)
Main PID: 24361 (fail2ban-server)
CGroup: /system.slice/fail2ban.service
└─24361 /usr/bin/python3 /usr/bin/fail2ban-server -s /var/run/fail...

Oct 06 12:10:29 mars fail2ban-client[24358]: 2016-10-06 12:10:29,293 fail2ba...5
Oct 06 12:10:29 mars fail2ban-client[24358]: 2016-10-06 12:10:29,294 fail2ba...e
Oct 06 12:10:29 mars systemd[1]: Started Fail2Ban Service.

Hint: Some lines were ellipsized, use -l to show in full.

You can enable other fail2ban service such as apache, ftp, etc.

If you need to latest version of fail2ban, download and install it from source xxx and manually configure its service.

References:

1. packages.debian.org/sid/all/fail2ban/download
2. launchpad.net/debian/+source/fail2ban
3. tracker.debian.org/pkg/fail2ban
4. wiki.debian.org/DebianUnstable
5. github.com/fail2ban/fail2ban