fail2ban with nftables

To make fail2ban ban with nftables, set banaction = nftables and banaction_allports = nftables[type=allports] under [DEFAULT] in /etc/fail2ban/jail.local. On Debian 13 and Ubuntu 24.04 or newer, that's already the packaged default. fail2ban then creates a table inet f2b-table with one set per jail, addr-set-<jail>. List the bans with sudo nft list table inet f2b-table.

[DEFAULT]
banaction          = nftables
banaction_allports = nftables[type=allports]

Is nftables already your default?#

Check what your jails actually use:

$ sudo fail2ban-client get sshd actions
The jail sshd has the following actions:
nftables

Debian 12 has nftables as its firewall framework but the fail2ban 1.0.2 package still defaults to iptables. The iptables commands go through the iptables-nft compatibility layer, so they work, but you get one rule per banned IP instead of a set. Switching is the two-line config above.

What the nftables action creates#

From action.d/nftables.conf, on the jail's first ban (not at startup) fail2ban runs the equivalent of:

nft add table inet f2b-table
nft -- add chain inet f2b-table f2b-chain { type filter hook input priority -1 \; }
nft add set inet f2b-table addr-set-sshd { type ipv4_addr\; flags interval\; }
nft add rule inet f2b-table f2b-chain tcp dport { ssh } ip saddr @addr-set-sshd reject

and for each ban, nft add element inet f2b-table addr-set-sshd { 203.0.113.42 }.

• One table, one chain, one set per jail and family. All jails share inet f2b-table and the base chain f2b-chain. IPv4 bans go into addr-set-<jail>, IPv6 bans into addr6-set-<jail>.
• Hook input, priority -1. The chain sees traffic addressed to this host and runs just before the usual filter chains at priority 0 (yours, firewalld's or UFW's). A ban can't be overridden by an accept in another table.
• flags interval (fail2ban 1.1.1, addr_options) lets a set hold CIDR ranges as well as single addresses.
• reject by default. Set blocktype to drop silently instead: banaction = nftables[blocktype=drop].
• The table only exists after the first ban. nft list table inet f2b-table reports an error on a fresh start. That's normal, not a failure.

When a jail stops, fail2ban deletes its rule and set, and deletes the table once no sets remain.

multiport vs allports#

type decides what the rule matches:

allports still matches only the jail's protocol, which defaults to tcp. To block every protocol for repeat offenders, including UDP and ICMP, use protocol = all:

[recidive]
enabled   = true
banaction = %(banaction_allports)s
protocol  = all

With protocol = all the rule has no protocol match at all, just ip saddr @addr-set-recidive reject. For jails on UDP services, set protocol = udp (for example OpenVPN) or protocol = tcp,udp. The action adds one rule per protocol.

View bans with nft#

# whole table: chain, rules and every set with its elements
sudo nft list table inet f2b-table

# one jail's IPv4 and IPv6 sets
sudo nft list set inet f2b-table addr-set-sshd
sudo nft list set inet f2b-table addr6-set-sshd

# is one address banned anywhere?
sudo nft list table inet f2b-table | grep 203.0.113.42

The set's elements = { ... } line holds the banned addresses. fail2ban's own view is the authoritative one, with expiry times:

$ sudo fail2ban-client get sshd banip --with-time
203.0.113.42 	2026-10-25 18:36:10 + 3600 = 2026-10-25 19:36:10

More listing options are on list banned IPs. Unban through fail2ban (fail2ban-client unban <IP>), not with nft delete element. Otherwise fail2ban still thinks the address is banned.

IPv6#

The table family is inet, so one table covers both IPv4 and IPv6. fail2ban picks the set by address family: addr-set-sshd for 203.0.113.42, addr6-set-sshd for 2001:db8::25. Nothing to configure, but check that the jail's log actually contains IPv6 addresses and that your ignoreip list includes your own IPv6 prefix.

Migrate from iptables to nftables#

If you also keep custom actions derived from iptables (before = iptables.conf), check them. 1.1.1 rewrote the iptables action and some tags changed. See the iptables guide.

nftables vs iptables for fail2ban#

With a few dozen bans you won't notice a difference. With thousands, iptables chains get slow and nftables sets don't. iptables-ipset closes most of that gap if you must stay on iptables.

"nft not found" and other errors#

If the nft binary is missing, bans fail. /var/log/fail2ban.log shows the failed command ending in -- returned 127, followed by HINT on 127: "Command not found". Install it:

sudo apt install nftables      # Debian, Ubuntu
sudo dnf install nftables      # Fedora, RHEL family

Minimal cloud images, containers and some appliance builds (Proxmox among them) ship without nft. fail2ban's package only recommends it. Then restart fail2ban. Other checks:

• Bans disappear after systemctl restart nftables. Debian's default /etc/nftables.conf starts with flush ruleset, which also deletes fail2ban's table. fail2ban doesn't notice. Restart fail2ban after reloading nftables, or replace flush ruleset with commands that flush only your own tables.
• Banned but still connecting. Docker published ports and traffic routed to VMs go through forward, not input, so the ban never matches. See banned but not blocked and the Docker guide.
• Running inside a container. fail2ban needs CAP_NET_ADMIN and host networking to change the host's nftables.
• SELinux denials (RHEL family, execmem) affected the nftables action before 1.1.1, which replaced its grep -P calls.

FAQ#

Does fail2ban work with nftables?#

Yes. The nftables action is built in and is the default on Debian 13 and Ubuntu 24.04+. It stores bans in sets inside its own inet f2b-table table and blocks them with one rule per jail. Enable it with banaction = nftables and banaction_allports = nftables[type=allports].

How do I see fail2ban bans in nftables?#

Run sudo nft list table inet f2b-table to see the chain, rules and every jail's set, or sudo nft list set inet f2b-table addr-set-sshd for one jail. IPv6 bans are in addr6-set-<jail>. The table only appears after the first ban.

How do I use nftables with fail2ban on Debian 12?#

Debian 12's fail2ban 1.0.2 defaults to iptables-multiport. Add banaction = nftables and banaction_allports = nftables[type=allports] to [DEFAULT] in /etc/fail2ban/jail.local, make sure the nftables package is installed, and restart fail2ban. Also set backend = systemd for sshd, since Debian 12 has no auth.log.

Why does fail2ban say nft not found?#

The nftables package isn't installed, or nft isn't in the PATH of the fail2ban service. The log shows the command -- returned 127 with a "Command not found" hint. Install it with apt install nftables or dnf install nftables, then restart fail2ban.