# Filters

You can customize, improve the filters Fail2Ban uses. You can find the filters in `/etc/fail2ban/filter.d/`. Below is a **small** collection of filters for the services, I have already covered.

**`nginx-http-auth.conf`**

```bash
[Definition]


failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <HOST>, server: \S+, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"\s*$
            ^ \[error\] \d+#\d+: \*\d+ no user/password was provided for basic authentication, client: <HOST>, server: \S+, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"\s*$

ignoreregex =
```

`<strong>nginx-badbots.conf</strong>`

```bash
sudo cp apache-badbots.conf nginx-badbots.conf
```

`<strong>nginx-noscript</strong>`

```bash
[Definition]

failregex = ^<HOST> -.*GET.*(\.php|\.asp|\.exe|\.pl|\.cgi|\.scgi)

ignoreregex =
```

`<strong>nginx-noproxy</strong>`

```bash
[Definition]

failregex = ^<HOST> -.*GET http.*

ignoreregex =
```

**MongoDB**

`<strong>mongo-auth.conf</strong>`

```bash
[INCLUDES]

before = common.conf

[Definition]

_daemon = mongodb

failregex = ^.*[aA]uthentication [fF]ail(ed|ure) for \w+ on \w+ from client <HOST>:[0-9].*|$

ignoreregex =

# Author: luiseok (https://github.com/luiseok)
```

<div class="page-content" id="bkmrk-"><div class="text-muted text-small"><div class="entity-meta">  
</div></div></div>