# fail2ban filter library > All 96 built-in fail2ban filters in one searchable list: sshd, nginx, Apache, Postfix, Dovecot, recidive and more, with regexes and sample log lines. > > Source: https://fail2ban.dev/filters/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1 > fail2ban.dev is an independent guide, not the official fail2ban project. A fail2ban **filter** is a file in **`/etc/fail2ban/filter.d/`** with regular expressions (`failregex`) that recognize failed logins and other abuse in a log and extract the attacker's IP. fail2ban 1.1.1 ships 96 filters: `sshd`, `nginx-http-auth`, `apache-auth`, `postfix`, `dovecot`, `recidive` and many more. A jail uses the filter with the same name unless you set `filter =`. The full searchable list is below. ```bash ``` Filters for the services people protect most are documented inside their setup guides, next to the jail configuration. Everything else is grouped by type: - [SSH](/guides/ssh/) — sshd, dropbear and selinux-ssh - [nginx](/guides/nginx/) and [Apache](/guides/apache/) — http-auth, botsearch, rate limits, bad bots and exploit scans - [Postfix and Dovecot](/guides/postfix-dovecot/) — SMTP, SASL, RBL and IMAP/POP3 failures - [Mail servers and webmail](/filters/mail-servers/) — Exim, Sendmail, Courier, Cyrus, Roundcube, Horde, SOGo and more - [Web apps, proxies and panels](/filters/web-apps/) — HAProxy, lighttpd, Squid, Grafana, Webmin, Guacamole and more - [FTP servers](/filters/ftp/) — vsftpd, ProFTPD, Pure-FTPd, WU-FTPD - [Network and system services](/filters/network-services/) — BIND, NSD, LDAP, xrdp, VPN, PAM, port-scan detectors - [Repeat offenders](/config/recidive/) — the recidive filter ## How filters, jails and actions fit together | Part | Lives in | Answers | |---|---|---| | Filter | `filter.d/.conf` | Which log lines are failures, and which IP caused them? | | Jail | `jail.conf` / `jail.local` | Which log to read, how many failures, how long to ban? | | Action | `action.d/.conf` | How to ban: firewall, email, report? | A jail section like `[nginx-http-auth]` automatically uses `filter.d/nginx-http-auth.conf`, because the default is `filter = %(__name__)s[mode=%(mode)s]`. Several jails can share one filter with different options: `postfix-sasl` is `filter = postfix[mode=auth]`. Enabling a jail is covered in the [jail.local example](/config/jail-local/); actions are in the [action library](/actions/). ## Most used filters - [sshd](/guides/ssh/#filter-sshd): SSH brute force; modes `normal`, `ddos`, `extra`, `aggressive` - [nginx-http-auth](/guides/nginx/#filter-nginx-http-auth): failed HTTP basic auth in nginx - [nginx-botsearch](/guides/nginx/#filter-nginx-botsearch): scans for phpMyAdmin, WordPress and other paths that don't exist - [nginx-bad-request](/guides/nginx/#filter-nginx-bad-request): 400 Bad Request responses in the access log - [nginx-limit-req](/guides/nginx/#filter-nginx-limit-req): clients hitting nginx `limit_req` / `limit_conn` - [apache-auth](/guides/apache/#filter-apache-auth): failed Apache authentication - [apache-badbots](/guides/apache/#filter-apache-badbots): known spam and email-harvesting bots - [postfix](/guides/postfix-dovecot/#filter-postfix): SMTP abuse and SASL login failures (mode `auth` for postfix-sasl) - [dovecot](/guides/postfix-dovecot/#filter-dovecot): IMAP/POP3 login failures - [recidive](/config/recidive/#filter-recidive): repeat offenders, from fail2ban's own log - [vaultwarden](/guides/vaultwarden/#filter-vaultwarden): failed Vaultwarden logins - [proxmox](/guides/proxmox/#create-the-proxmox-filter): failed Proxmox VE web UI logins ## How to choose a filter 1. **Find out where the service logs failures.** A file (`/var/log/nginx/error.log`) or the journal (`journalctl -u ssh`). Note one real failure line. 2. **Look for a matching filter** in the list below. Search by service name. Many filters have modes; the filter page lists them. 3. **Test it against your real log** before enabling the jail, e.g. `sudo fail2ban-regex /var/log/nginx/error.log nginx-http-auth` or `sudo fail2ban-regex systemd-journal sshd`. The summary line shows how many lines matched. Zero matches on a log that contains failures means the filter doesn't fit your log format. See [fail2ban-regex](/fail2ban-regex/) for the options. 4. **No filter fits?** Write your own in a few lines: [custom filter guide](/filters/custom/). The [regex tester](/tools/regex-tester/) lets you try regexes against pasted log lines in the browser. Popular applications without a stock filter ([Nextcloud](/guides/nextcloud/), [WordPress](/guides/wordpress/), [Jellyfin](/guides/jellyfin/), [Home Assistant](/guides/home-assistant/), [Gitea](/guides/gitea/)…) are covered in the [guides](/guides/), with tested filters. ## Customize a stock filter Don't edit files in `filter.d/` that came with the package; upgrades overwrite them. Instead: - **Change a mode or parameter from the jail**: `filter = sshd[mode=aggressive]` or `mode = aggressive` in the jail. - **Add regexes or ignores**: create `filter.d/.local` with `failregex = %(known/failregex)s` plus your lines. The `.local` is read after the `.conf`. - **Something very different**: copy the filter to a new name (`filter.d/sshd-custom.conf`) and point the jail at it. ## Where the filters come from The stock filters live in the upstream repository under [`config/filter.d`](https://github.com/fail2ban/fail2ban/tree/master/config/filter.d), each with test log samples in `fail2ban/tests/files/logs/`. Distribution packages install them unchanged to `/etc/fail2ban/filter.d/`. A newer fail2ban release often brings filter fixes (the 1.1.1 `sshd` filter, for example, matches the `sshd-session` process name used since OpenSSH 9.8), so check the version you run with `fail2ban-client --version`. Files in `filter.d/` that aren't filters on their own, like `common.conf`, `apache-common.conf` and `botsearch-common.conf`, hold shared regex fragments that other filters include. ## All built-in filters Search by name or description. Each name opens the filter's page with its full definition, modes, the jails that use it and example log lines. ## FAQ ### Where are fail2ban filters located? In `/etc/fail2ban/filter.d/`. Each `.conf` file is one filter, named after the file without the extension (`sshd.conf` is the `sshd` filter). Your own changes go in a `.local` file with the same name, or in a new `.conf` file for a completely custom filter. ### How many filters does fail2ban have? fail2ban 1.1.1 ships 96 filters, covering SSH, web servers (nginx, Apache, lighttpd), mail servers (Postfix, Dovecot, Exim, Sendmail), FTP, databases, VoIP and many web applications. Run `ls /etc/fail2ban/filter.d/` to see the ones installed on your system. ### Can I use one filter for several jails? Yes. Set `filter = ` in each jail. You can pass different parameters per jail, for example `filter = postfix[mode=auth]` in one jail and `filter = postfix[mode=rbl]` in another, which is exactly how the stock `postfix-sasl` and `postfix-rbl` jails work.