fail2ban-client commands

fail2ban-client sends commands to the running fail2ban server over its Unix socket. The syntax is fail2ban-client [OPTIONS] <COMMAND>, and it needs root. The most used commands are sudo fail2ban-client status (list jails), status <jail> (failures and bans), set <jail> unbanip <IP>, set <jail> banip <IP> and reload. Run fail2ban-client -h to print every command your installed version supports.

sudo fail2ban-client status                       # list jails
sudo fail2ban-client status sshd                  # one jail: failures, bans, banned IPs
sudo fail2ban-client set sshd banip 203.0.113.42  # ban an IP
sudo fail2ban-client set sshd unbanip 203.0.113.42
sudo fail2ban-client reload                       # re-read configuration

fail2ban-client syntax#

fail2ban-client [OPTIONS] <COMMAND>

<COMMAND> is a sequence of words such as status sshd or set sshd bantime 1h. Three verbs cover most of it:

• Server and jail control: start, stop, restart, reload, status, ping.
• get reads a setting: get loglevel (server-wide) or get <jail> bantime (per jail).
• set changes a setting at runtime: set loglevel DEBUG or set <jail> maxretry 3.

Runtime set changes take effect immediately but are not saved. The next reload or restart applies whatever is in your configuration files again, so put permanent changes in /etc/fail2ban/jail.local — see the jail.local example.

The jail name is the section name in your configuration ([sshd], [nginx-http-auth], [recidive]), not the filter file name. If you mistype it, the client tells you:

$ sudo fail2ban-client status sshdx
... ERROR   NOK: ('sshdx',)
Sorry but the jail 'sshdx' does not exist

Global options#

Options go before the command. These are the ones from fail2ban-client -h in 1.1.1:

A few of these are worth knowing by heart:

$ sudo fail2ban-client --version
Fail2Ban v1.1.1

# test the configuration without touching the running server
sudo fail2ban-client -t

# show exactly what fail2ban will load for each jail
sudo fail2ban-client -d | grep sshd

# how many seconds is 1d12h?
fail2ban-client --str2sec 1d12h

-t prints OK: configuration test is successful, or the errors and ERROR: test configuration failed. More on that in testing your configuration.

Interactive mode#

fail2ban-client -i opens a prompt where you type commands without the fail2ban-client prefix. Type help for the command list and exit or quit to leave. It's handy when you run many get/set commands in a row:

$ sudo fail2ban-client -i
fail2ban> status sshd
fail2ban> get sshd maxretry
fail2ban> exit

Status and listing jails#

$ sudo fail2ban-client status
Status
|- Number of jail:	2
`- Jail list:	recidive, sshd

$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42

Since 1.1.0 you can also get every jail at once with status --all and a compact table with stats. Each field is explained on the fail2ban status page.

Ban and unban commands#

$ sudo fail2ban-client set sshd banip 192.0.2.15 192.0.2.16
2
$ sudo fail2ban-client set sshd unbanip 192.0.2.15
1
$ sudo fail2ban-client unban 192.0.2.16
1

banip and unbanip print the number of addresses they changed, not OK. unban <IP> (without a jail) removes the address from every jail and from the database; unban --all clears everything. Details and edge cases: unban an IP and ban an IP manually.

To see what is banned:

$ sudo fail2ban-client banned
[{'sshd': ['203.0.113.42']}, {'recidive': []}]
$ sudo fail2ban-client banned 203.0.113.42
[['sshd']]
$ sudo fail2ban-client get sshd banip --with-time
203.0.113.42 	2026-10-25 18:36:10 + 3600 = 2026-10-25 19:36:10

More ways to list banned IPs, including from the firewall and the database.

fail2ban-client get: read jail settings#

get <jail> <option> shows the value the running jail actually uses — after jail.conf, jail.d/ and jail.local have been merged. That makes it the quickest way to check whether your override took effect.

$ sudo fail2ban-client get sshd bantime
3600
$ sudo fail2ban-client get sshd findtime
600
$ sudo fail2ban-client get sshd maxretry
3
$ sudo fail2ban-client get sshd logpath
Current monitored log file(s):
`- /var/log/auth.log
$ sudo fail2ban-client get sshd actions
The jail sshd has the following actions:
nftables

Times are always printed in seconds, even if you wrote 1h in the config. Other useful get commands: get <jail> ignoreip, get <jail> failregex, get <jail> journalmatch, get <jail> usedns, and server-wide get loglevel, get logtarget, get dbfile, get dbpurgeage.

fail2ban-client set: change settings at runtime#

$ sudo fail2ban-client set sshd bantime 86400
86400
$ sudo fail2ban-client set sshd addignoreip 192.168.1.0/24
These IP addresses/networks are ignored:
|- 127.0.0.0/8
|- 192.168.1.0/24
`- ::1

Useful runtime changes:

sudo fail2ban-client set sshd maxretry 3
sudo fail2ban-client set sshd findtime 1h
sudo fail2ban-client set sshd delignoreip 192.168.1.0/24
sudo fail2ban-client set loglevel DEBUG
sudo fail2ban-client set sshd idle on      # pause the jail without stopping it

Remember: these vanish on reload. Copy them into jail.local once you are happy with them. The jail options reference lists what each setting does.

Start, stop, restart and reload#

On systemd hosts, use sudo systemctl restart fail2ban for the service and fail2ban-client reload for config changes. Which one you need for which change is covered in restart vs reload.

Logging and database commands#

$ sudo fail2ban-client get loglevel
Current logging level is 'INFO'
$ sudo fail2ban-client get logtarget
Current logging target is:
`- /var/log/fail2ban.log
$ sudo fail2ban-client get dbpurgeage
Current database purge age is:
`- 86400seconds

set loglevel <LEVEL> accepts CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG, TRACEDEBUG and HEAVYDEBUG. flushlogs reopens the log file after rotation. See fail2ban logs for log locations and levels.

When fail2ban-client can't reach the server#

$ sudo fail2ban-client status
2026-10-25 18:36:27,357 fail2ban                [2083]: ERROR   Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?

The server isn't running, or you forgot sudo (the socket is only accessible to root). Check sudo systemctl status fail2ban and read failed to access socket. If the command itself is missing (fail2ban-client: command not found), fail2ban isn't installed — see install fail2ban.

Complete fail2ban-client command list#

All 96 commands from the fail2ban 1.1.1 protocol, grouped as fail2ban-client -h prints them. <JAIL>, <IP> and similar are placeholders. The command builder fills them in for you.

Basic#

Logging#

Database#

Jail Control#

Jail Configuration#

Command Action Configuration#

General Action Configuration#

Jail Information#

Command Action Information#

General Action Information#

FAQ#

How do I list all jails in fail2ban?#

Run sudo fail2ban-client status. It prints the number of jails and a comma-separated Jail list. For the details of every jail in one go, use sudo fail2ban-client status --all (fail2ban 1.1.0 and later), or loop over the names with status <jail> on older versions.

Why does fail2ban-client say "command not found"?#

fail2ban isn't installed, or you're using an account whose PATH lacks /usr/bin (or /usr/local/bin for a source install). Install the fail2ban package for your distribution, then run the client with sudo. In Docker, run it inside the container with docker exec <container> fail2ban-client status.

Are changes made with fail2ban-client set permanent?#

No. set changes only the running server. A reload, a restart of the service or a reboot reapplies the configuration files. To keep a change, put it in /etc/fail2ban/jail.local (or a file in jail.d/) and run sudo fail2ban-client reload.

How do I see all fail2ban-client commands for my version?#

Run fail2ban-client -h. It prints the options and every command the installed version supports, with a one-line description. man fail2ban-client shows the same list. Older versions such as 1.0.2 lack status --all and stats, which arrived in 1.1.0.