# fail2ban integration guides > Step-by-step fail2ban integration guides: SSH, nginx, Apache, reverse proxies, Cloudflare, Docker, self-hosted apps, mail, VPN, firewalls and monitoring. > > Source: https://fail2ban.dev/guides/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1 > fail2ban.dev is an independent guide, not the official fail2ban project. Every guide below follows the same pattern: find the log line a failed login or attack produces, match it with a filter (stock or custom, tested with `fail2ban-regex`), enable a jail in `/etc/fail2ban/jail.local` or `jail.d/`, make sure the ban lands where the traffic actually flows, and verify with `fail2ban-client status `. If fail2ban isn't installed yet, start with [install fail2ban](/install/). ## SSH and the system - [SSH](/guides/ssh/) — The sshd jail done right: systemd backend, custom ports, aggressive mode for key-only servers, OpenSSH 9.8+ `sshd-session`. - [Proxmox web UI](/guides/proxmox/) — Ban brute force on the Proxmox VE login on port 8006, plus PBS and PMG. - [OpenWrt routers](/guides/openwrt/) — dropbear and LuCI jails on a router, nftables, and banIP as the lightweight option. ## Web servers and reverse proxies - [Nginx](/guides/nginx/) — nginx-http-auth, botsearch, limit-req with `limit_req_zone`, bad requests, forbidden, and a 404/401/403 filter. - [Apache](/guides/apache/) — All nine stock Apache jails, apache2 vs httpd log paths, the LogLevel trap, a 404 filter. - [Nginx Proxy Manager](/guides/nginx-proxy-manager/) — NPM's own log format, a tested filter and bans in DOCKER-USER. - [Traefik](/guides/traefik/) — Access log setup, the traefik-auth modes, Docker Compose, real client IPs. - [Caddy](/guides/caddy/) — A JSON access-log filter for `client_ip` and status codes with the `ts` epoch timestamp. - [Cloudflare](/guides/cloudflare/) — Restore real visitor IPs and ban at Cloudflare's edge with an API token, including Tunnel. ## Self-hosted apps - [WordPress](/guides/wordpress/) — wp-login.php and xmlrpc.php brute force, with the WP fail2ban plugin or without any plugin. - [Nextcloud](/guides/nextcloud/) — Filter for `Login failed` in nextcloud.log, log paths for Docker, AIO and snap. - [Vaultwarden](/guides/vaultwarden/) — The stock vaultwarden filter, `LOG_FILE`, a stricter admin-page jail. - [Jellyfin](/guides/jellyfin/) — Denied-login filter and a setup that survives Jellyfin's daily log files. - [Home Assistant](/guides/home-assistant/) — Container and Core setups, the built-in IP ban, and Home Assistant OS limits. - [Gitea & Forgejo](/guides/gitea/) — Ban password spraying on self-hosted Git servers, including GitLab's stock filter. - [MySQL & MariaDB](/guides/mysql/) — Make the database log failed logins, then ban password sprayers. - [Minecraft servers](/guides/minecraft/) — A tested filter for whitelist and session rejections in latest.log, and the limits for game servers. ## Mail and VoIP - [Postfix & Dovecot](/guides/postfix-dovecot/) — The postfix, postfix-sasl and dovecot jails against SMTP AUTH and IMAP guessing. - [Asterisk & FreePBX](/guides/asterisk/) — Ban SIP REGISTER floods on TCP and UDP before they make calls on your account. ## VPN - [OpenVPN](/guides/openvpn/) — Ban failed TLS handshakes, certificate checks and password logins. - [WireGuard](/guides/wireguard/) — Why there's no WireGuard jail, and the one workaround. ## Firewalls and ban actions - [UFW](/guides/ufw/) — Ban through UFW rules or alongside UFW in nftables. - [nftables](/guides/nftables/) — The default ban action on Debian 13 and Ubuntu 24.04: tables, sets, inspection. - [firewalld](/guides/firewalld/) — The firewalld actions on Fedora, RHEL, Rocky and AlmaLinux, and their traps. - [iptables & ipset](/guides/iptables/) — The rewritten 1.1.1 iptables action, ipset for large ban lists. ## Operations and integrations - [Docker containers](/guides/docker/) — Why bans miss published ports, `chain = DOCKER-USER`, the nftables forward hook, reading container logs. - [AbuseIPDB reporting](/guides/abuseipdb/) — Report banned IPs automatically. - [Prometheus & Grafana](/guides/monitoring/) — Exporters and scripts for Prometheus, node_exporter and Zabbix. - [Web UI & dashboards](/guides/monitoring/#does-fail2ban-have-a-gui) — Third-party web interfaces, from Webmin to Docker-based UIs. ## Which guide do I need? - **Your service runs in Docker** (NPM, Vaultwarden, Nextcloud AIO, Jellyfin…): read the app's guide *and* [Docker containers](/guides/docker/). A ban in the default `INPUT` chain doesn't stop traffic Docker forwards to a container. - **Your site is behind Cloudflare or another proxy**: fail2ban must see the visitor's address, not the proxy's. Fix that first; see [Cloudflare](/guides/cloudflare/) and [fail2ban bans the proxy IP](/troubleshooting/reverse-proxy-ip/). - **On Ubuntu 24.04**: the package sets `backend = systemd` for all jails, so every jail that reads a log file needs `backend = auto` — all examples in these guides include it. - **No guide for your app?** Write a filter for its log line with the [filter generator](/tools/filter-generator/), test it, and follow [writing a custom filter](/filters/custom/). The [jail.local generator](/tools/jail-generator/) builds the jail. ## FAQ ### How do I protect a new service with fail2ban? Find the log line the service writes on a failed login and confirm it contains the client IP. Write a filter whose `failregex` matches that line with `` or ``, test it with `fail2ban-regex `, then add a jail with `enabled = true`, the `logpath`, the `port` and `backend = auto`, and reload fail2ban. ### Why does fail2ban ban IPs but my Docker app is still reachable? Docker forwards published ports to containers through the `FORWARD` chain, while fail2ban bans in `INPUT` by default. Use an iptables action with `chain = DOCKER-USER`, or an nftables chain on the forward hook, for every jail that protects a container.