THE NEW ACTIONBAN COMMAND
The new actionban command for CloudFlare IP address blocking is as follows…
actionban = curl -s -X POST https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules -H "Authorization: Bearer <cfkey>" -H "Content-Type: application/json" --data '{"mode":"block","configuration":{"target":"ip","value":"<ip>"},"notes":"Banned by Fail2Ban"}'
actionunban = curl -s -X GET -H "Authorization: Bearer <cfkey>" -H "Content-Type: application/json" "https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules?page=1&per_page=5&mode=block&configuration.target=ip&configuration.value=<ip>¬es=Banned by Fail2Ban&match=all&order=configuration.value&direction=desc" | python -c "import sys, json; print json.load(sys.stdin)['result'][0]['id'];" | xargs -I@@ curl -s -X DELETE -H "Authorization: Bearer <cfkey>" -H "Content-Type: application/json" https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules/@@
IMPLEMENTATION
We could modify the /etc/fail2ban/action.d/cloudflare.conf