$ show itskenny0/fail2ban-endlessh
This is a configuration-only infrastructure repository: it extends fail2ban so that a banned IP is not simply blocked, but has its SSH traffic redirected to a local endlessh tarpit on port 2222. The repository ships two fail2ban action definitions and one jail snippet. The iptables action inserts a NAT PREROUTING REDIRECT rule for the banned source IP on port 22; the firewalld action uses firewall-cmd rich rules with forward-port to the same effect. A jail.d config attaches the default endlessh action to the sshd jail. There is no application code, test suite, build system, or packaging; the artifact is three drop-in configuration files meant to be copied into /etc/fail2ban. This makes the project extremely simple and dependency-light, relying only on fail2ban and either iptables or firewalld. The core idea is clever and portable: instead of dropping malicious traffic, the system wastes an attacker's time against a tarpit. The two firewall backends give useful coverage across common Linux distributions. As a codebase it is minimal, and the craftsmanship lies in the choice of firewall rules rather than in software architecture. The files are clean, follow fail2ban's action and jail conventions, and are directly reusable by anyone already running endlessh on port 2222.
The LLM identified 2 files worth highlighting for reuse:
Defines a fail2ban action that, on ban, adds an iptables NAT PREROUTING rule redirecting the banned IP's TCP port 22 traffic to local port 2222 (endlessh) and removes it on unban. The pattern of redirecting instead of blackholing is a reusable way to turn fail2ban bans into a tarpit feeder.
Firewalld equivalent of the endlessh action, using firewall-cmd rich rules with forward-port to send banned IPs' port 22 traffic to endlessh on port 2222. Demonstrates how to implement the same fail2ban action pattern on an alternative firewall backend with minimal configuration.