fail2ban FAQ

fail2ban is a free, open-source tool that watches log files for repeated failures — wrong SSH passwords, failed web logins, mail authentication errors — and temporarily blocks the offending IP addresses in your firewall. It isn't a firewall itself and doesn't stop DDoS floods, but it cheaply removes most brute-force noise. The nine most asked questions are in the FAQ section at the end; topical questions come first.

General questions#

What is a jail in fail2ban?#

A jail is one protection rule: which log to read, which filter finds failures in it, how many failures (maxretry) within which window (findtime) trigger a ban, how long the ban lasts (bantime), and what action blocks the address. Jails are sections like [sshd] in jail.local. How fail2ban works explains every term.

Who maintains fail2ban, and is there an official website?#

fail2ban was created by Cyril Jaquier in 2004 and is maintained by Serg G. Brester (sebres), Yaroslav Halchenko and contributors on GitHub at github.com/fail2ban/fail2ban. The old fail2ban.org domain redirects there. fail2ban.dev is an independent documentation site and isn't affiliated with the project.

Does fail2ban have a GUI or web interface?#

No. fail2ban has no official GUI; you manage it with fail2ban-client and text files. Some control panels, such as Webmin and Plesk, include a fail2ban page, third-party dashboards add a web view, and you can export metrics to Grafana. Options are compared in fail2ban web UI and dashboards.

Does fail2ban work on Windows?#

No. fail2ban runs on Linux, the BSDs and macOS; it relies on Unix firewalls and log files. On Windows, use a native tool that reads the Event Log — such as IPBan or wail2ban — or Windows Defender Firewall rules. See fail2ban for Windows alternatives.

Does fail2ban run on macOS and FreeBSD?#

Yes. fail2ban ships paths-freebsd.conf and paths-osx.conf, and on those systems the default ban action uses the pf firewall. Install it from ports or pkg on FreeBSD and from Homebrew or source on macOS.

Security questions#

Can attackers get around fail2ban?#

Yes, partly. A botnet that tries one password from each of thousands of IPs never reaches maxretry from a single address, and slow attackers can stay under findtime. fail2ban also only sees what's logged. Treat it as noise reduction on top of strong authentication, and use the recidive jail or incremental bans to slow down repeat offenders.

Can fail2ban lock me out of my own server?#

Yes, if you fail to log in too many times from your own IP. Add your static addresses or LAN to ignoreip before enabling jails, and keep your provider's console as a fallback. If it happens, unban your IP from another connection, then whitelist it.

Can attackers make fail2ban ban someone else?#

Only if a filter can be tricked by attacker-controlled text in the log. That has happened: CVE-2026-109786 let a crafted SSH username make the sshd filter blame an arbitrary IP, and older CVEs affected Apache and Postfix filters. Keep fail2ban updated and whitelist your critical addresses. Details on fail2ban security advisories.

Configuration questions#

Should I edit jail.conf or jail.local?#

Never edit jail.conf — package upgrades overwrite it. Create /etc/fail2ban/jail.local (or files in jail.d/) with only the settings you change. fail2ban reads jail.conf, then jail.d/*.conf, then jail.local, then jail.d/*.local, and later values win. Start from the jail.local example.

What are the default bantime, findtime and maxretry?#

In the stock jail.conf: bantime = 10m, findtime = 10m, maxretry = 5. So five failures within ten minutes earn a ten-minute ban. Most people raise bantime to an hour or a day in jail.local. Tune them with bantime, findtime and maxretry.

Does fail2ban work with nftables, ufw and firewalld?#

Yes. fail2ban 1.1.1 uses nftables by default on Debian, Ubuntu, Fedora, Arch and openSUSE, and ships actions for ufw, firewalld, iptables, ipset, pf and others. Set the one you want with banaction in jail.local. See ban actions, fail2ban with UFW and fail2ban with firewalld.

Does fail2ban work with Cloudflare?#

Yes, with two pieces of setup. Behind Cloudflare your server sees Cloudflare's IPs, so first make the web server log the real visitor IP (CF-Connecting-IP) — otherwise fail2ban bans Cloudflare. Then use the cloudflare-token action to block attackers at Cloudflare's edge, because a local firewall rule can't block proxied traffic. Full setup: fail2ban with Cloudflare.

Does fail2ban work with Docker?#

It can run on the host or in a container. Two things matter: the jail must read the container's logs (a mounted log file or the journal), and bans must go into the DOCKER-USER chain, because Docker's published ports bypass the INPUT chain. See fail2ban with Docker containers.

Can fail2ban ban permanently?#

Yes. bantime = -1 makes bans in that jail permanent, and they survive restarts through the ban database. Use it on a dedicated jail or the recidive jail rather than everywhere. See ban an IP permanently.

Can fail2ban send email alerts?#

Yes. Set destemail, sender and action = %(action_mw)s (ban and mail with whois) or %(action_mwl)s (with log lines) in jail.local. It needs a working local mailer such as sendmail or Postfix. Setup on email alerts.

Operations questions#

How do I know fail2ban is working?#

Run sudo fail2ban-client status sshd. A growing Total failed shows the filter is matching log lines; Total banned above zero shows bans are happening. sudo tail -f /var/log/fail2ban.log shows Found and Ban lines live. Every field is explained on fail2ban status.

Do fail2ban bans survive a reboot?#

Yes. Bans are stored in /var/lib/fail2ban/fail2ban.sqlite3 and fail2ban restores the ones that haven't expired when it starts. Restarting is therefore not a way to clear bans — use fail2ban-client unban --all.

Where are fail2ban's logs?#

fail2ban writes to /var/log/fail2ban.log by default; start-up errors go to journalctl -u fail2ban. Check the target with sudo fail2ban-client get logtarget. See fail2ban logs.

How do I disable fail2ban?#

Run sudo systemctl disable --now fail2ban. That stops the service, removes its firewall rules and keeps it from starting at boot. To disable one jail only, set enabled = false for it in jail.local and run sudo fail2ban-client reload.

How do I update fail2ban?#

Use your package manager (apt upgrade fail2ban, dnf upgrade fail2ban). Distribution versions lag behind upstream; for the latest release use the .deb attached to the GitHub release or install from source. Version details and the upgrade path are on fail2ban versions.

FAQ#

Is fail2ban a firewall?#

No. fail2ban doesn't filter traffic itself. It reads logs, decides which IPs misbehave, and tells your real firewall — nftables, iptables, firewalld, ufw or pf — to block them for a while. Without a firewall action it can only log. That's why the ban action you choose matters: see ban actions.

Is fail2ban necessary if I use SSH keys?#

Not strictly. With password authentication disabled, brute-force attempts against SSH can't succeed, so fail2ban adds no protection there. It still cuts log noise and attack traffic, and it remains useful for services that must accept passwords — mail, web logins, FTP. Many admins run both. See secure SSH with fail2ban.

Does fail2ban prevent DDoS attacks?#

No. A volumetric DDoS saturates your network link before any log line is written, and the traffic comes from too many addresses to ban one by one. fail2ban can help against a small application-level flood from a few IPs (for example with the nginx-limit-req filter), but real DDoS protection needs your provider or a CDN.

Is fail2ban free and open source?#

Yes. fail2ban is free software released under the GNU General Public License version 2 or later. The source code, issue tracker and releases are on GitHub at github.com/fail2ban/fail2ban, and every major Linux distribution packages it. There is no paid edition.

Does fail2ban work with IPv6?#

Yes, since version 0.10. Filters match IPv6 addresses, and the nftables, iptables and ipset actions block them in separate IPv6 sets or chains. With allowipv6 = auto (the default) fail2ban detects whether IPv6 is enabled. Write IPv6 addresses in ignoreip and commands exactly as you would IPv4 ones, for example 2001:db8::25.

Does fail2ban need iptables?#

No. fail2ban needs a firewall, not iptables specifically. Version 1.1.1 defaults to nftables on Debian, Ubuntu, Fedora, Arch and openSUSE and to pf on FreeBSD and macOS. Actions also exist for firewalld, ufw, ipset, hosts.deny, routes and cloud APIs. Older versions defaulted to iptables-multiport.

Is fail2ban an IDS or an IPS?#

It is a simple host-based intrusion prevention tool. Like an IDS it detects attacks — but only from log files, not by inspecting packets. Like an IPS it reacts by blocking the source. It doesn't analyze traffic, detect exploits or malware, so it complements rather than replaces tools like Suricata or a WAF.

Is fail2ban safe to use?#

Yes, with normal care. It runs as root because it changes firewall rules, so keep it updated, keep /etc/fail2ban writable by root only, and never give untrusted users access to fail2ban-client. Past vulnerabilities and hardening steps are listed on fail2ban security advisories.

Is fail2ban only for SSH?#

No. SSH is the most common use, but fail2ban 1.1.1 ships 96 filters for web servers, mail servers, FTP, VPNs, VoIP, databases and web applications, and you can write your own for anything that logs failures with an IP address — even a Minecraft server or an OpenWrt router. Browse the filter library or write a custom filter.