Independent guide · checked against fail2ban 1.1.1

fail2ban, explained and automated.

fail2ban watches your logs for repeated failed logins and bans the attacking IP in your firewall. This site has everything to run it well: install guides for every distro, every fail2ban-client command, ready jail.local examples, a library of all 96 filters — and free tools that run in your browser.

Install fail2ban Try the regex tester
Locked out? Unban an IP: sudo fail2ban-client set sshd unbanip 203.0.113.42 More unban commands →
SecurityCVE-2026-109786: the sshd filter in 0.10.5–1.1.1 can be tricked into banning any IP — here's the two-line fix →
96built-in filters documented
66ban & notify actions
96fail2ban-client commands
99.7%regex-tester agreement with fail2ban on 1,028 test lines

How it works

From failed login to firewall rule in under a second

fail2ban reads a log, matches each line against a filter, counts failures per IP in a jail, and when an address reaches maxretry within findtime it runs a ban action — usually an nftables or iptables rule — for bantime. Try it:

Log/var/log/auth.log
or systemd journal
Filterfailregex finds
<HOST>
Jailcounts failures
Actionbanaction runs
on maxretry
Firewall(no rule)
Waiting for failures

    Quick start

    Protect SSH in three steps

    Five minutes on any modern Linux server. Every step is explained in depth in the install guides.

    1. 1

      Install the package

      bash
      sudo apt update && sudo apt install fail2ban
sudo systemctl enable --now fail2ban
    2. 2

      Create jail.local

      Never edit jail.conf — upgrades overwrite it. Put your settings in /etc/fail2ban/jail.local:

      /etc/fail2ban/jail.local
      [DEFAULT]
# never ban yourself: add your own IP or LAN
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
backend = systemd
    3. 3

      Reload and check

      bash
      sudo fail2ban-client reload
sudo fail2ban-client status sshd

      You should see Status for the jail: sshd with a file list or journal match. Full walkthrough: install fail2ban.

    Free tools

    Test filters and build configs in your browser

    Nothing is uploaded: the tools run entirely on your machine, so you can paste real logs safely.

    Most usedfail2ban regex testerPaste log lines, pick any built-in filter or write your own failregex, and see exactly what fail2ban would match and ban.Open tool jail.local generatorTick the services you run, set ban times and your whitelist, and copy a clean, commented jail.local.Open tool Log analyzerDrop in auth.log or an nginx access log: top attacking IPs, failures per minute, and who your jails would ban.Open tool Bantime calculatorConvert 1d12h to seconds and see how incremental bans grow for repeat offenders.Open tool Filter generatorPaste one log line, click the IP, get a working failregex and filter file.Open tool Command builderUnban, ban, whitelist, status — fill in jail and IP, copy the exact fail2ban-client command.Open tool

    Popular

    What people come here to do

    Unban an IPfail2ban-client set sshd unbanip 203.0.113.42List banned IPsfail2ban-client status sshdjail.local example[sshd] enabled = trueProtect SSHsshd jail, custom port, aggressive modeProtect nginxhttp-auth, botsearch, limit-reqWhitelist your IPignoreip = 127.0.0.1/8 ::1 …fail2ban not banning?The 9 causes, in order of likelihoodfail2ban in Dockercompose file, DOCKER-USER chainBan repeat offendersrecidive jail & incremental bansfail2ban cheat sheetevery command on one printable pageFilter libraryall 96 built-in filters, searchablefail2ban vs CrowdSecwhich one fits your servers

    What is fail2ban?#

    fail2ban is a free, open-source intrusion-prevention tool for Linux and other Unix-like systems. It watches log files — or the systemd journal — for signs of brute-force attacks, such as repeated failed SSH logins, and temporarily bans the offending IP addresses by adding firewall rules. Out of the box it protects SSH; with its 96 bundled filters it also guards web servers, mail servers, VPNs, databases and many self-hosted apps.

    fail2ban is written in Python and released under the GNU GPL v2. It was created by Cyril Jaquier in 2004 and is maintained today by a community of contributors on GitHub. The current release is fail2ban 1.1.1. It is packaged by every major distribution, so apt install fail2ban or dnf install fail2ban is usually all it takes to install it.

    What does fail2ban do, exactly?#

    Every internet-facing server is scanned constantly. Bots try thousands of username and password combinations against SSH, hammer WordPress wp-login.php, and probe for phpMyAdmin. fail2ban turns the evidence those bots leave in your logs into action:

    1. Read — a backend follows a log file (/var/log/auth.log, /var/log/nginx/error.log…) or the systemd journal in real time.
    2. Match — a filter of regular expressions (failregex) recognises failure lines and extracts the client address from the <HOST> tag.
    3. Count — the jail counts failures per IP. When an address reaches maxretry failures within findtime, it is banned.
    4. Ban — an action runs, usually adding the IP to an nftables or iptables set. After bantime the action is reversed automatically.

    A jail is simply the combination of one filter, one or more actions and those three numbers. The stock defaults are maxretry = 5, findtime = 10m and bantime = 10m; most admins raise the ban time and enable incremental bans or the recidive jail for repeat offenders. The full picture is in how fail2ban works.

    Is fail2ban still worth using in 2026?#

    Yes, for most single servers. Key-only SSH already stops password guessing, but fail2ban still cuts log noise and wasted CPU, blocks scanners before they find a weak service, and protects things that do take passwords — web logins, mail, VPN and admin panels. It needs no external service and sends no data anywhere. If you run many servers and want shared threat intelligence, compare it with CrowdSec; fail2ban and CrowdSec can even run side by side.

    What fail2ban is not: it isn't a firewall (it drives yours), it isn't a WAF (it doesn't inspect requests, only logs), and it can't stop a large distributed DDoS. See the alternatives for the tools that cover those layers.

    Where to go next#

    Install fail2banUbuntu, Debian, Rocky/Alma, Fedora, Arch, Docker, Raspberry Pijail.local examplea complete, commented production configfail2ban-client commandsevery command with real outputFilter libraryall 96 built-in filters with test linesIntegration guidesnginx, Apache, Nextcloud, Vaultwarden, Proxmox and moreTroubleshootingnot banning, no log file, socket errors, Docker

    FAQ

    fail2ban questions, answered

    What is fail2ban used for?#

    fail2ban protects servers from brute-force and abuse by banning IP addresses that show malicious behaviour in logs — most often repeated failed SSH logins, but also failed web, mail, FTP or VPN logins and vulnerability scans. It bans them through the firewall for a set time.

    Is fail2ban still used?#

    Yes, widely. It is actively maintained — version 1.1.0 came out in April 2024 and 1.1.1 in August 2026 — and packaged by Debian, Ubuntu, Fedora/EPEL, Arch, FreeBSD and OpenWrt. Hosting panels such as Plesk and HestiaCP build on it. Newer tools like CrowdSec add shared blocklists, but fail2ban remains the default first line of defence on single Linux servers.

    How effective is fail2ban?#

    Very effective against brute force from individual addresses, which is most of what hits a server. A bot guessing one password every 6 seconds makes 14,400 attempts a day; with maxretry = 5 and bantime = 1h it gets at most about 120, and incremental bans cut that to a handful. It is weak against botnets that spread guesses over thousands of IPs, does nothing for unlogged exploits, and can't stop DDoS — so pair it with key-only SSH and strong passwords.

    Where is fail2ban on GitHub?#

    The source code, issue tracker and releases are at github.com/fail2ban/fail2ban. Releases are tagged there (the latest is 1.1.1) with a .deb attached; the master branch is the development version. This site is independent of the project — see fail2ban versions for installing a release from GitHub.

    See what fail2ban would ban — before you deploy.

    Paste a slice of auth.log or an nginx access log into the log analyzer and get the attacking IPs, the jails that would catch them and the commands to act.

    Open the log analyzer