# fail2ban action library

> All 66 fail2ban actions in action.d: firewall bans (nftables, iptables, ufw, firewalld), email and chat alerts, abuse reporting, with parameters.
>
> Source: https://fail2ban.dev/actions/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

A fail2ban **action** is a file in **`/etc/fail2ban/action.d/`** that defines the commands run when a jail bans or unbans an IP. Firewall actions such as `nftables`, `iptables-multiport`, `ufw` and `firewallcmd-rich-rules` block the address; other actions send email (`sendmail-whois`), chat notifications (`apprise`) or abuse reports (`abuseipdb`). fail2ban 1.1.1 ships 66 of them. A jail can run several actions at once.

```bash
sudo fail2ban-client get sshd actions
```

| Setting | Purpose | Example |
|---|---|---|
| `banaction` | The firewall action used by every jail through the shortcuts | `banaction = nftables` |
| `banaction_allports` | Firewall action for all-ports bans (`recidive`) | `banaction_allports = nftables[type=allports]` |
| `action` | The full list of actions for a jail; by default `%(action_)s` = `banaction` with the jail's ports | `action = %(action_mw)s` |
| Extra actions | Add more lines to `action` | ban + AbuseIPDB report + Telegram |

Most setups only change `banaction` ([choosing a banaction](/config/banaction/)) and maybe `action` for [email alerts](/config/email-alerts/). Several actions look like this:

```ini
[sshd]
enabled = true
action  = %(action_)s
          abuseipdb[abuseipdb_apikey="YOUR_KEY", abuseipdb_category="18,22"]
          apprise[config="/etc/fail2ban/apprise.conf"]
```

## Action categories

### Firewall (ban) actions

These block traffic from the banned IP. Use one that matches the firewall you actually run.


- [nftables](/actions/#action-nftables): nftables sets in table `inet f2b-table`; default since 1.1.1 on Debian paths
- [iptables-multiport](/actions/#action-iptables-multiport): iptables chain `f2b-<jail>` for the jail's ports
- [iptables-ipset](/actions/#action-iptables-ipset): iptables with an ipset; efficient for many bans
- [ufw](/actions/#action-ufw): ufw rules, for systems managed with ufw
- [firewallcmd-rich-rules](/actions/#action-firewallcmd-rich-rules): firewalld rich rules (Fedora, RHEL family)
- [firewallcmd-ipset](/actions/#action-firewallcmd-ipset): firewalld with an ipset
- [route](/actions/#action-route): blackhole route, no firewall needed
- [cloudflare-token](/actions/#action-cloudflare-token): block at Cloudflare's edge with an API token

Others: `iptables-allports`, `iptables-new`, `iptables-multiport-log`, `nftables-allports`, `nftables-multiport`, `firewallcmd-allports`, `firewallcmd-multiport`, `firewallcmd-new`, `shorewall`, `shorewall-ipset-proto6`, `pf` (BSD/macOS), `ipfw`, `bsd-ipfw`, `npf`, `ipfilter`, `osx-afctl`, `osx-ipfw`, `apf`, `csf`, `hostsdeny`, `mikrotik` (RouterOS address lists), `netscaler`, `nginx-block-map`, `nsupdate` (DNS blocklist zone), `symbiosis-blacklist-allports`, `cloudflare` (legacy global API key).

### Notification actions


- [sendmail-whois](/actions/#action-sendmail-whois): email with whois report (used by `action_mw`)
- [sendmail-whois-lines](/actions/#action-sendmail-whois-lines): adds log lines (used by `action_mwl`)
- [apprise](/actions/#action-apprise): Telegram, Discord, Slack, ntfy and many more via Apprise
- [smtp](/actions/#action-smtp): Python action that talks to an SMTP server directly

Also: `sendmail`, `sendmail-buffered`, `sendmail-whois-matches`, `sendmail-whois-ipmatches`, `sendmail-whois-ipjailmatches`, `sendmail-geoip-lines`, and the `mail`, `mail-whois`, `mail-whois-lines`, `mail-buffered` family for `mta = mail`. Setup and testing: [email alerts](/config/email-alerts/).

### Reporting actions

Share attacker IPs with blocklist services. Use them only for jails where false positives are unlikely, since you're reporting someone to the world.

- [abuseipdb](/actions/#action-abuseipdb): report to AbuseIPDB (needs an API key; see the [AbuseIPDB guide](/guides/abuseipdb/))
- [blocklist_de](/actions/#action-blocklist_de): report to blocklist.de
- [dshield](/actions/#action-dshield), [mynetwatchman](/actions/#action-mynetwatchman), [ipthreat](/actions/#action-ipthreat): other reporting services
- [xarf-login-attack](/actions/#action-xarf-login-attack), [complain](/actions/#action-complain): email the abuse contact from whois

### Testing and helper files

- [dummy](/actions/#action-dummy): writes bans to a file instead of touching the firewall; ideal for testing a new jail safely
- `helpers-common`, `sendmail-common`, `mail-whois-common`, `firewallcmd-common`: shared definitions included by other actions, not used directly

## Customize an action

Don't edit files in `action.d/`; package upgrades replace them.

- **Change a parameter for one jail**: brackets in the jail, e.g. `banaction = nftables[blocktype=drop]`.
- **Change it everywhere**: create `action.d/<name>.local` with the changed `[Init]` or `[Definition]` keys only. It's read after the `.conf`.
- **New behavior** (a webhook, an API call, your own script): write a new action, see [custom actions](/actions/custom/).

## Check what a jail is running

```text
$ sudo fail2ban-client get sshd actions
The jail sshd has the following actions:
nftables
```

```bash
```

Search by name or description. Each name opens the action's page with its commands, parameters and usage.



## FAQ

### Where are fail2ban actions located?

In `/etc/fail2ban/action.d/`. Each `.conf` file is a shell-command action named after the file (`nftables.conf` is the `nftables` action); `.py` files such as `smtp.py` are Python actions. Put your changes in a `.local` file with the same name, or create a new file for a custom action.

### Can a jail have multiple actions?

Yes. List them in `action`, one per line, with the continuation lines indented, for example `%(action_)s` followed by `abuseipdb[...]`. Every action runs on each ban. To use the same action twice with different settings, give each an `actname`, such as `smtp.py[dest=a@example.com, actname=smtp-a]`.

### How do I test a fail2ban action?

Ban a documentation address by hand with `sudo fail2ban-client set <jail> banip 192.0.2.15`; every action of the jail runs. Check the firewall or your inbox, then `sudo fail2ban-client set <jail> unbanip 192.0.2.15`. Errors appear in `/var/log/fail2ban.log`.