# EdgeRouter Fail2Ban Persistence Through Upgrades

My last post detailed  [how to install and configure Fail2Ban on a Ubiquiti EdgeRouter](https://jason.rokea.ch/mitigating-an-openvpn-brute-force-attack-with-fail2ban-on-edgerouter)  to thwart brute force attacks against an OpenVPN server. Unfortunately, programs installed on EdgeRouters do not persist through upgrades because new images overwrite the filesystem. However, using a trick outlined here, we can set up the router to automatically install Fail2Ban and restore the settings.

First, copy your Fail2Ban configurations from the previous post into /config and create symlinks from the old location to the new:

```
sudo -i
mkdir /config/fail2ban
mkdir /config/fail2ban/filter.d
mv /etc/fail2ban/filter.d/openvpn.local /config/fail2ban/filter.d/
mv /etc/fail2ban/jail.local /config/fail2ban/
rm /etc/fail2ban/jail.local 
ln -s /config/fail2ban/jail.local /etc/fail2ban/jail.local
ln -s /config/fail2ban/filter.d/openvpn.local /etc/fail2ban/filter.d/openvpn.local
```

You may wish to confirm that Fail2Ban still works after a `service fail2ban restart`

Next, use `vi` to create a file at `/config/scripts/post-config.d/install_fail2ban.sh` with the content:

```
#!/bin/bash 
packages='fail2ban'
doneit='/var/lib/fail2ban_installed'
 if [ -e $doneit ]; then 
 exit 0 
fi
mount -t tmpfs -o size=30% tmpfs /var/lib/apt/lists
if [ $? != 0 ]; then
 echo Could not mount tmpfs on /var/lib/apt/lists 
 exit 1
fi
DEBIAN_FRONTEND=noninteractive apt-get update apt-get --no-install-recommends install -y $packages

if [ $? == 0 ]; then
 echo Package install successful
 ln -s /config/fail2ban/jail.local /etc/fail2ban/jail.local
 ln -s /config/fail2ban/filter.d/openvpn.local /etc/fail2ban/filter.d/openvpn.local
 service fail2ban restart
 touch $doneit 
else 
 echo Package install failed 
fi 
umount /var/lib/apt/lists
exit 0
```

Make sure that the script is executable via `chmod 744 /config/scripts/post-config.d/install_fail2ban.sh`

You should now be able to upgrade the router normally and the package and configuration will be automatically restored.

Note: If you are running an ER-X or ER-X-SFP, these may not have enough space to successfully install the software, in which case, you will need to delete the old system image via `delete system image` before the script can run successfully. After doing so, run the script manually via `sudo /config/scripts/post-config.d/install_fail2ban.sh` or reboot the router again.