Install fail2ban on Arch Linux

To install fail2ban on Arch Linux, run sudo pacman -S fail2ban nftables. The package (1.1.1 in the extra repository) uses Arch's paths file, so the sshd jail reads the systemd journal by default. Create /etc/fail2ban/jail.local with banaction = nftables and an enabled [sshd] jail, then run sudo systemctl enable --now fail2ban.

sudo pacman -S fail2ban nftables
sudo systemctl enable --now fail2ban

Arch doesn't enable the service or any jail on install — both steps are yours.

What the Arch package includes#

Because python-systemd is a hard dependency, the journal backend always works. No firewall tool is required, though — install the one you plan to use, or the first ban fails with "command not found".

The systemd backend on Arch#

Arch has no syslog daemon by default; everything goes to the journal. The Arch package points jail.conf at paths-arch.conf, which sets the systemd backend for the services that log there:

syslog_backend = systemd
sshd_backend = systemd
dropbear_backend = systemd
postfix_backend = systemd
dovecot_backend = systemd

So the stock [sshd] jail (backend = %(sshd_backend)s) reads the journal using the filter's journalmatch, with no logpath needed. Jails for applications that write files — nginx, Apache — keep backend = auto and use logpath. See backends and the systemd journal.

Configure the sshd jail and nftables ban action#

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
bantime.maxtime = 1w
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
enabled = true

Replace the ignoreip addresses with your own LAN and admin IP (whitelisting with ignoreip). Setting banaction explicitly is deliberate. Upstream moved the default ban action into the paths-*.conf files: 1.1.1 sets nftables in paths-debian.conf, and the development branch adds the same default to paths-arch.conf. Naming it in jail.local makes the choice independent of which paths file your package version contains.

Using iptables or firewalld instead? Set banaction = iptables-multiport / banaction_allports = iptables-allports, or banaction = firewallcmd-rich-rules, and install the matching package. Choosing a ban action compares them.

sudo fail2ban-client -t
sudo systemctl restart fail2ban

Verify#

sudo fail2ban-client status sshd
sudo nft list table inet f2b-table

The sshd status shows Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd + _COMM=sshd-session — Arch's OpenSSH logs failures under the sshd-session process name, which fail2ban 1.1.1 matches. The nftables table appears after the first ban; to create one right away, ban a documentation address and remove it:

sudo fail2ban-client set sshd banip 192.0.2.15
sudo nft list table inet f2b-table
sudo fail2ban-client set sshd unbanip 192.0.2.15

Check that the filter actually matches your journal with fail2ban-regex: sudo fail2ban-regex systemd-journal sshd.

Optional: harden the fail2ban service#

fail2ban runs as root because it changes firewall rules. You can narrow what the process may touch with a systemd drop-in (sudo systemctl edit fail2ban):

[Service]
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=read-only
ProtectSystem=strict
ReadWritePaths=-/var/run/fail2ban
ReadWritePaths=-/var/lib/fail2ban
ReadWritePaths=-/var/log/fail2ban.log
ReadWritePaths=-/run/xtables.lock
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW

Then sudo systemctl daemon-reload && sudo systemctl restart fail2ban, and test a ban. Any action that writes elsewhere — sending mail through a local MTA spool, writing a block list file — needs its own ReadWritePaths line. If bans stop working after this change, remove the drop-in first.

Manjaro and other Arch-based distributions#

Manjaro, EndeavourOS and Garuda use the same fail2ban package. On Manjaro it arrives a little later, because Manjaro holds Arch packages back for testing before they reach its stable branch:

sudo pacman -S fail2ban nftables   # or: pamac install fail2ban

Everything else on this page applies. Desktop installs rarely need fail2ban unless you expose SSH or another service to the internet.

Keeping fail2ban updated#

sudo pacman -Syu updates fail2ban with the rest of the system. pacman never overwrites a modified file in /etc/fail2ban; it saves the new version as .pacnew instead. That's another reason to keep your changes in jail.local and jail.d/*.local: the .conf files then stay unmodified and update cleanly. After an upgrade, run sudo fail2ban-client -t before restarting.

FAQ#

How do I install fail2ban on Arch Linux?#

Run sudo pacman -S fail2ban nftables. Create /etc/fail2ban/jail.local with banaction = nftables under [DEFAULT] and enabled = true under [sshd], then sudo systemctl enable --now fail2ban. The Arch package is in the extra repository and is version 1.1.1.

Does fail2ban on Arch use the systemd journal?#

Yes. Arch's paths-arch.conf sets sshd_backend = systemd and the same for postfix, dovecot and syslog-based jails, and python-systemd is a required dependency. Jails for applications that write their own log files still use those files.

Does fail2ban work with nftables on Arch?#

Yes. Install the nftables package and set banaction = nftables and banaction_allports = nftables[type=allports] in jail.local. fail2ban creates its own inet f2b-table table, so it doesn't interfere with your /etc/nftables.conf rules.

Is fail2ban available on Manjaro?#

Yes. Manjaro uses the Arch package from its own mirrors: sudo pacman -S fail2ban or pamac install fail2ban. It reaches Manjaro stable a little after Arch. Configuration and the systemd backend are identical.