Commands

fail2ban cheat sheet

The fail2ban commands, files and settings you need day to day, on one printable page. Every command needs root, so prefix them with sudo.

Updated 5 min readChecked against fail2ban 1.1.1

This fail2ban cheat sheet covers the commands you use most: fail2ban-client status <jail> to see bans, set <jail> unbanip <IP> and set <jail> banip <IP> to change them, reload after editing /etc/fail2ban/jail.local, and fail2ban-regex to test filters. Settings go in jail.local, never jail.conf. All commands below need sudo.

Service control (systemd)#

Task Command
Start / stop systemctl start fail2ban / systemctl stop fail2ban
Restart the service systemctl restart fail2ban
Reload config systemctl reload fail2ban or fail2ban-client reload
Start at boot systemctl enable --now fail2ban
Is it running? systemctl status fail2ban or fail2ban-client ping
Service log journalctl -u fail2ban -e

Status#

Task Command
List jails fail2ban-client status
One jail (failures, bans, IPs) fail2ban-client status sshd
All jails at once (1.1.0+) fail2ban-client status --all
Summary table (1.1.0+) fail2ban-client stats
Version fail2ban-client --version
output
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42

Field meanings: fail2ban status explained.

Ban and unban#

Task Command
Ban an IP in a jail fail2ban-client set sshd banip 203.0.113.42
Ban a subnet fail2ban-client set sshd banip 198.51.100.0/24
Unban from one jail fail2ban-client set sshd unbanip 203.0.113.42
Unban from all jails + database fail2ban-client unban 203.0.113.42
Unban everything fail2ban-client unban --all
Restart a jail, drop its bans fail2ban-client restart --unban sshd

banip/unbanip print a number: how many addresses changed (1 = done, 0 = nothing to do). Guides: unban an IP, ban an IP manually.

List banned IPs#

Task Command
All jails, as a list fail2ban-client banned
Which jail banned this IP? fail2ban-client banned 203.0.113.42
One jail, space-separated fail2ban-client get sshd banip
One jail, with ban/expiry times fail2ban-client get sshd banip --with-time
One per line fail2ban-client get sshd banip | tr ' ' '\n'
In nftables nft list set inet f2b-table addr-set-sshd
In iptables iptables -L f2b-sshd -n

More: list banned IPs.

Whitelist (ignoreip)#

/etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
Task Command
Show ignore list fail2ban-client get sshd ignoreip
Add at runtime fail2ban-client set sshd addignoreip 192.168.1.0/24
Remove at runtime fail2ban-client set sshd delignoreip 192.168.1.0/24

Runtime changes are lost on reload. Details: whitelist IPs with ignoreip.

Read and change settings at runtime#

Task Command
Ban time (seconds) fail2ban-client get sshd bantime
Set ban time fail2ban-client set sshd bantime 1d
Find time / max retry get sshd findtime, get sshd maxretry
Set max retry fail2ban-client set sshd maxretry 3
Monitored logs fail2ban-client get sshd logpath
Journal match fail2ban-client get sshd journalmatch
Actions in use fail2ban-client get sshd actions
Pause a jail fail2ban-client set sshd idle on

Reload and test#

Task Command
Test config fail2ban-client -t
Dump merged config fail2ban-client -d
Reload all jails fail2ban-client reload
Reload one jail fail2ban-client reload sshd
Full restart, clear all bans fail2ban-client reload --restart --unban

When to use which: restart vs reload.

Logs#

Task Command
Follow fail2ban's log tail -f /var/log/fail2ban.log
Bans only grep '\] Ban ' /var/log/fail2ban.log
Top banned IPs grep -oP '\] Ban \K\S+' /var/log/fail2ban.log | sort | uniq -c | sort -rn | head
Log level fail2ban-client get loglevel / set loglevel DEBUG
Log target fail2ban-client get logtarget
log
2026-10-25 18:36:10,238 fail2ban.filter         [1997]: INFO    [sshd] Found 203.0.113.42 - 2026-10-25 18:36:10
2026-10-25 18:36:11,027 fail2ban.actions        [1997]: NOTICE  [sshd] Ban 203.0.113.42

More recipes: fail2ban logs.

Test filters with fail2ban-regex#

Task Command
Jail/filter vs log file fail2ban-regex /var/log/auth.log sshd
Filter file fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
systemd journal fail2ban-regex systemd-journal sshd
Inline regex fail2ban-regex /var/log/auth.log 'Failed password for .* from <HOST>'
Show matched lines add --print-all-matched
Only the IPs add -o ip
Filter mode fail2ban-regex /var/log/auth.log 'sshd[mode=aggressive]'

Full guide: fail2ban-regex. Or paste lines into the online regex tester.

Files and paths#

Path What it is
/etc/fail2ban/jail.conf Stock jails and defaults — don't edit
/etc/fail2ban/jail.local Your overrides (create it)
/etc/fail2ban/jail.d/*.conf, *.local Drop-in jail files (distro defaults live here)
/etc/fail2ban/fail2ban.conf / .local Server settings: log, socket, database
/etc/fail2ban/filter.d/ Filters (regexes)
/etc/fail2ban/action.d/ Actions (firewall commands, mail…)
/etc/fail2ban/paths-*.conf Distro log paths and default banaction
/var/log/fail2ban.log fail2ban's own log
/var/lib/fail2ban/fail2ban.sqlite3 Ban database
/var/run/fail2ban/fail2ban.sock Client–server socket

Load order: jail.conf → jail.d/*.conf → jail.local → jail.d/*.local. Later files win.

Time units#

Write Means
600 600 seconds (plain numbers are seconds)
30s, 10m, 1h seconds, minutes, hours
1d, 1w day, week
1mo, 1y month, year (m is minutes, so month is mo)
1d12h combinations add up (129600 s)
-1 forever (bantime = -1 = permanent ban)

Check any value with fail2ban-client --str2sec 1d12h. Pick ban times with the bantime calculator.

Minimal jail.local#

/etc/fail2ban/jail.local
[DEFAULT]
# never ban yourself
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
# Debian 12 has no /var/log/auth.log by default:
# backend = systemd

Then sudo fail2ban-client -t && sudo systemctl reload fail2ban. A fuller template is on the jail.local example page, or build one with the jail.local generator.

FAQ#

What are the most important fail2ban commands?#

fail2ban-client status lists jails, fail2ban-client status sshd shows bans for one jail, fail2ban-client set sshd unbanip <IP> removes a ban, fail2ban-client set sshd banip <IP> adds one, and fail2ban-client reload applies config changes. fail2ban-regex tests filters against your logs.

How do I check if fail2ban is working?#

Run sudo fail2ban-client ping (it answers Server replied: pong), then sudo fail2ban-client status sshd. A rising Total failed count means the filter is matching log lines; a non-zero Total banned means bans are happening. tail /var/log/fail2ban.log shows Found and Ban lines as they occur.

How do I make fail2ban ban forever?#

Set bantime = -1 for the jail in jail.local and reload. For repeat offenders only, enable the recidive jail or bantime.increment instead, so first-time typos still expire. Permanent bans are kept in the database and restored after a restart.

fail2ban-client commandsEvery fail2ban-client command with syntax, options and real output: status, ban, unban, reload, get and set at runtime, plus the complete command list.Unban an IPUnban an IP in fail2ban with fail2ban-client: from one jail, from all jails, unban everything, IPv6 and Docker, and stop the same IP getting banned again.List banned IPsList banned IPs in fail2ban: status <jail>, banned, get banip --with-time, all jails at once, check one IP, and read bans from nftables, iptables or the database.jail.local exampleA complete fail2ban jail.local example for SSH, nginx and recidive, explained line by line, plus a minimal version, distro notes and how to add a custom jail.fail2ban-regexHow to use fail2ban-regex to test a fail2ban filter or regex against a log file or the systemd journal, read the results and debug missed lines, with examples.

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.