[root@relay ~]# fail2ban-client -V
0.10.4
[root@relay ~]# uname -a
FreeBSD 10.4-RELEASE-p5

[apache-auth]
enabled = true
filter = apache-auth
port     = http,https
logpath  = %(apache_error_log)s
bantime  = 604800m
findtime  = 10m
maxretry = 4

[root@relay ~]# fail2ban-regex /var/log/httpd-error.log /usr/local/etc/fail2ban/filter.d/apache-auth.conf

Running tests
=============

Use   failregex filter file : apache-auth, basedir: /usr/local/etc/fail2ban
Use      datepattern : Default Detectors
Use         log file : /var/log/httpd-error.log
Use         encoding : UTF-8


Results
=======

Failregex: 25 total
|-  #) [# of hits] regular expression
|   1) [25] ^client (?:denied by server configuration|used wrong authentication scheme)\b
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [25] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 25 lines, 0 ignored, 25 matched, 0 missed
[processed in 0.01 sec]

2019-02-06 16:42:14,998 fail2ban.jail           [28620]: INFO    Creating new jail 'apache-auth'
2019-02-06 16:42:14,998 fail2ban.jail           [28620]: INFO    Jail 'apache-auth' uses poller {}
2019-02-06 16:42:14,998 fail2ban.jail           [28620]: INFO    Initiated 'polling' backend
2019-02-06 16:42:15,007 fail2ban.filter         [28620]: INFO    Added logfile: '/var/log/httpd-error.log' (pos = 108771, hash = 68b329da9893e34099c7d8ad5cb9c940)
2019-02-06 16:42:15,007 fail2ban.filter         [28620]: INFO      maxRetry: 4
2019-02-06 16:42:15,008 fail2ban.filter         [28620]: INFO      encoding: UTF-8
2019-02-06 16:42:15,008 fail2ban.filter         [28620]: INFO      findtime: 600
2019-02-06 16:42:15,008 fail2ban.actions        [28620]: INFO      banTime: 36288000
2019-02-06 16:42:15,044 fail2ban.jail           [28620]: INFO    Jail 'apache-auth' started

${fwcmd} table 1 flush
${fwcmd} zero
${fwcmd} -f flush
${fwcmd} nat 1 delete
# Сетевая карта в которую вставлен провод от провайдера.
	extif="igb1"
# Сетевая карта смотрящая во внутреннюю сеть.
	LanIn="igb0"
setup_loopback
# Заполнение таблиц запрета
   cat /etc/tables/full_block | while read ip; do
      ${fwcmd} table 1 add $ip 1
   done
# Исключение из запрета
   cat /etc/tables/AllowSites | while read ip; do
      ${fwcmd} table 2 add $ip 1
   done   

# kernel nat - most trendy.
${fwcmd} nat 1 config if ${extif} log reset same_ports
${fwcmd} add nat 1 all from any to any in via ${extif}
${fwcmd} add allow ip from table\(2\) to any in via ${extif}
${fwcmd} add deny log logamount 2048 all from table\(1\) to any in via ${extif}
${fwcmd} add nat 1 all from 10.10.0.0/21 to any out via ${extif}
${fwcmd} add allow ip from any to any out via ${extif}

${fwcmd} add allow all from any to any via igb0

# Доступ в DNS серверу.
${fwcmd} add allow tcp from any to ${IpOut} 53 in via ${extif} setup

# Запрещаем всё и в лог.
${fwcmd} add 65534 deny log all from any to any

cat /etc/tables/full_block | while read ip; do
      ${fwcmd} table 1 add $ip 1
   done
${fwcmd} add deny log logamount 2048 ip from table\(1\) to any in via ${extif}

${fwcmd} add deny log logamount 2048 ip from table\(1\) to any in via ${extif}

${fwcmd} add allow ip from 128.199.36.165 to any