About fail2ban.dev

fail2ban.dev is an independent website that documents fail2ban, the open-source tool that scans log files and bans IP addresses showing malicious behaviour. fail2ban itself has no official website of its own — fail2ban.org redirects to the project's GitHub repository — so this site tries to be the practical manual many administrators wish existed: installation, configuration, every filter and action, troubleshooting and browser-based tools.

What we cover#

• Getting started: installing fail2ban on Ubuntu, Debian, RHEL-family systems, Fedora, Arch, Raspberry Pi, Proxmox and Docker, and what changed in each version.
• Configuration: jail.local, ban times, incremental bans, ban actions, backends, whitelisting and email alerts.
• Reference: every fail2ban-client command, every upstream filter and action, and an FAQ.
• Guides: protecting SSH, Nginx, Apache, mail servers, Nextcloud, Vaultwarden, Home Assistant, reverse proxies, Cloudflare and more.
• Troubleshooting: the errors and "it isn't banning" situations people actually search for.
• Comparisons: honest comparisons with CrowdSec, SSHGuard, CSF, DenyHosts, reaction, UFW, WAFs and Windows tools — including when another tool is the better choice.
• Tools: a regex tester, filter and jail generators, a log analyzer, a ban-time calculator and a command builder. They run entirely in your browser.

The site is written for system administrators, DevOps engineers, homelab users and anyone running a server exposed to the internet.

How pages are checked#

Accuracy matters more than volume on a security topic, so we work from primary sources:

• Checked against the source code. Option names, default values, file paths and commands are verified against the fail2ban 1.1.1 source tree — jail.conf, the filter.d and action.d directories, the paths-*.conf files, the client protocol definition and the man pages. Where behaviour differs between versions or distributions, the page says so.
• Generated reference pages. The pages for individual filters and actions, the command reference and the default-settings tables are generated directly from the upstream configuration files, so they match what ships with fail2ban rather than a hand-copied summary.
• Real command output. Terminal output shown on the site was captured from a running fail2ban instance. We don't invent output formats; when we haven't captured a command's output, we show the command without it.
• A tested regex engine. The in-browser regex tester was validated against fail2ban's own test logs: on the 1,028 sample lines from the upstream test suite it agreed with fail2ban's results on 99.7% of them. The remaining differences come from edge cases in how a browser's regex engine differs from Python's, and the tool points you to fail2ban-regex for a definitive answer.
• Third-party facts checked at the source. Claims about other software — distribution packages, Docker images, CrowdSec, Cloudflare — are checked against official documentation or repositories, and comparison pages carry the date they were checked.
• Documentation addresses only. Examples use the reserved documentation ranges (203.0.113.0/24, 198.51.100.0/24, 192.0.2.0/24, 2001:db8::/32) so nobody copies a real address into their configuration.

Each article shows the date it was last updated. Pages checked against the current fail2ban release say so under the title.

Corrections#

If something is wrong, out of date or unclear, we want to know. Send the page URL and what you think is incorrect through the contact page; corrections are reviewed and the page's "updated" date changes when a fix is published. We can't offer one-to-one server support, but reports that improve a page help everyone who reads it.

Credits#

fail2ban was created by Cyril Jaquier in 2004 and is maintained by Serg G. Brester (sebres), Yaroslav Halchenko and many contributors. Everything documented here is their work; this site only explains it. The project's contributors are listed in its THANKS file and on GitHub.

Licensing of quoted material#

fail2ban is free software released under the GNU General Public License, version 2 or later. Configuration excerpts quoted on this site — filter regexes, action commands, jail.conf defaults — come from the fail2ban source and remain under that license, with copyright held by their respective authors. They are quoted for documentation purposes with attribution to the fail2ban project. The surrounding explanations, guides and tools are original work of fail2ban.dev. See the terms of use for details.

"fail2ban" is the name of the open-source project and belongs to it; we use it only to describe the software we document.