# Fail2ban filter for Traefik bad requests
# Blocks IPs that generate excessive 4xx errors (bad requests, forbidden, etc.)

[Definition]
failregex = ^.*"ClientAddr":"<HOST>:\d+".*"RequestMethod":"(GET|POST|PUT|DELETE|PATCH)".*"DownstreamStatus":4\d{2}.*$
ignoreregex = ^.*"DownstreamStatus":(401|404|429).*$

# Catches all 4xx errors except 401, 404, 429 (handled by specific filters)
# Example: 400 Bad Request, 403 Forbidden, etc.