# Install fail2ban on Arch Linux

> Install fail2ban on Arch Linux or Manjaro with pacman: 1.1.1 from extra, systemd journal backend, nftables bans, the sshd jail and optional service hardening.
>
> Source: https://fail2ban.dev/install/arch/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To install fail2ban on Arch Linux, run `sudo pacman -S fail2ban nftables`. The package (1.1.1 in the `extra` repository) uses Arch's paths file, so the sshd jail reads the systemd journal by default. Create `/etc/fail2ban/jail.local` with `banaction = nftables` and an enabled `[sshd]` jail, then run `sudo systemctl enable --now fail2ban`.

```bash
sudo systemctl enable --now fail2ban
```

## What the Arch package includes

| Item | Value |
|---|---|
| Repository | `extra` (formerly `community`) |
| Version | 1.1.1 |
| Required dependencies | `python-systemd`, `python-pyinotify`, `sqlite`, `whois` |
| Optional (firewall back ends) | `nftables`, `iptables`, `ipset`, `firewalld` |
| Paths file | `/etc/fail2ban/paths-arch.conf` |
| Service | `fail2ban.service` (not enabled by default) |

Because `python-systemd` is a hard dependency, the journal backend always works. No firewall tool is required, though — install the one you plan to use, or the first ban fails with "command not found".

## The systemd backend on Arch

Arch has no syslog daemon by default; everything goes to the journal. The Arch package points `jail.conf` at `paths-arch.conf`, which sets the systemd backend for the services that log there:

```ini
syslog_backend = systemd
sshd_backend = systemd
dropbear_backend = systemd
postfix_backend = systemd
dovecot_backend = systemd
```

## Configure the sshd jail and nftables ban action

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
bantime.maxtime = 1w
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
enabled = true
```

Using iptables or firewalld instead? Set `banaction = iptables-multiport` / `banaction_allports = iptables-allports`, or `banaction = firewallcmd-rich-rules`, and install the matching package. [Choosing a ban action](/config/banaction/) compares them.

```bash
sudo systemctl restart fail2ban
```

```bash
sudo nft list table inet f2b-table
```

```bash
sudo nft list table inet f2b-table
sudo fail2ban-client set sshd unbanip 192.0.2.15
```

## Optional: harden the fail2ban service

fail2ban runs as root because it changes firewall rules. You can narrow what the process may touch with a systemd drop-in (`sudo systemctl edit fail2ban`):

```ini
[Service]
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=read-only
ProtectSystem=strict
ReadWritePaths=-/var/run/fail2ban
ReadWritePaths=-/var/lib/fail2ban
ReadWritePaths=-/var/log/fail2ban.log
ReadWritePaths=-/run/xtables.lock
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
```

## Manjaro and other Arch-based distributions

Manjaro, EndeavourOS and Garuda use the same `fail2ban` package. On Manjaro it arrives a little later, because Manjaro holds Arch packages back for testing before they reach its stable branch:

```bash
```

## Keeping fail2ban updated

`sudo pacman -Syu` updates fail2ban with the rest of the system. pacman never overwrites a modified file in `/etc/fail2ban`; it saves the new version as `.pacnew` instead. That's another reason to keep your changes in `jail.local` and `jail.d/*.local`: the `.conf` files then stay unmodified and update cleanly. After an upgrade, run `sudo fail2ban-client -t` before restarting.

## FAQ

### How do I install fail2ban on Arch Linux?

Run `sudo pacman -S fail2ban nftables`. Create `/etc/fail2ban/jail.local` with `banaction = nftables` under `[DEFAULT]` and `enabled = true` under `[sshd]`, then `sudo systemctl enable --now fail2ban`. The Arch package is in the `extra` repository and is version 1.1.1.

### Does fail2ban on Arch use the systemd journal?

Yes. Arch's `paths-arch.conf` sets `sshd_backend = systemd` and the same for postfix, dovecot and syslog-based jails, and `python-systemd` is a required dependency. Jails for applications that write their own log files still use those files.

### Does fail2ban work with nftables on Arch?

Yes. Install the `nftables` package and set `banaction = nftables` and `banaction_allports = nftables[type=allports]` in jail.local. fail2ban creates its own `inet f2b-table` table, so it doesn't interfere with your `/etc/nftables.conf` rules.

### Is fail2ban available on Manjaro?

Yes. Manjaro uses the Arch package from its own mirrors: `sudo pacman -S fail2ban` or `pamac install fail2ban`. It reaches Manjaro stable a little after Arch. Configuration and the systemd backend are identical.