Install and set up fail2ban on Ubuntu

To install fail2ban on Ubuntu, run sudo apt update && sudo apt install fail2ban. The package starts the service and enables the sshd jail automatically on Ubuntu 22.04, 24.04 and 26.04. Then create /etc/fail2ban/jail.local with your ignoreip and ban times, run sudo systemctl restart fail2ban, and check it with sudo fail2ban-client status sshd.

sudo apt update
sudo apt install fail2ban nftables
sudo systemctl status fail2ban
sudo fail2ban-client status sshd

Installing nftables alongside is cheap insurance: Ubuntu 24.04 and 26.04 default to the nftables ban action, and the package only recommends nftables, so the nft command can be missing if iptables is already installed.

fail2ban version on each Ubuntu release#

The latest upstream release is 1.1.1. Ubuntu doesn't backport new fail2ban versions to LTS releases, so 24.04 stays on 1.0.2 with security fixes only. That's fine for SSH protection; if you need a 1.1.x feature, install from source.

What defaults-debian.conf changes on Ubuntu#

Ubuntu's package adds /etc/fail2ban/jail.d/defaults-debian.conf. It's the reason fail2ban "just works" after install, and it's also the source of most Ubuntu-specific surprises. Look at yours:

cat /etc/fail2ban/jail.d/defaults-debian.conf

[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]
backend = systemd

[sshd]
enabled = true

[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
backend = systemd
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
enabled = true

[sshd]
enabled = true

Don't edit defaults-debian.conf — it's a package file. Override it in jail.local, which is read after jail.d/*.conf.

Configure fail2ban on Ubuntu: jail.local for SSH#

Create /etc/fail2ban/jail.local:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
bantime.maxtime = 1w

[sshd]
enabled = true
mode = normal

• ignoreip: your LAN and the public IP you manage the server from. See whitelist IPs.
• bantime.increment: repeat offenders get 1h, 2h, 4h… up to a week. Details in incremental bans.
• If SSH listens on another port, add port = 2222 to [sshd] — otherwise the ban blocks port 22 only.

Test and apply:

sudo fail2ban-client -t
sudo systemctl restart fail2ban

Adding nginx or Apache jails on Ubuntu 24.04#

Because 24.04 puts backend = systemd in [DEFAULT], a jail like nginx-http-auth silently ignores its logpath and reads the journal instead, where nginx's errors never appear. The jail starts, shows no errors, and never bans anyone. Set the backend back to file monitoring for each file-based jail:

[nginx-http-auth]
enabled = true
backend = auto

auto uses pyinotify if installed and polling otherwise. Ubuntu 22.04 and 26.04 don't need this. The nginx guide has the full set of web jails, and backends and the systemd journal explains the options.

fail2ban and UFW on Ubuntu#

UFW and fail2ban work together without extra configuration. Two choices:

Keep the default nftables action (24.04, 26.04). fail2ban creates its own inet f2b-table table with a chain on the input hook at priority -1, which runs before UFW's rules. A banned IP is rejected even if UFW allows the port. UFW doesn't know about these bans, so ufw status won't list them — check with:

sudo nft list table inet f2b-table

Use the ufw action, if you want bans to show up in sudo ufw status:

[DEFAULT]
banaction = ufw
banaction_allports = ufw

The ufw action runs ufw prepend reject from <ip> to any on ban and deletes the rule on unban. It's slower than an nftables set when you have thousands of bans, because each ban is a separate rule. Pick one approach per server. Mixing them makes bans hard to trace. The UFW guide covers both in depth.

Also remember the basics: sudo ufw allow OpenSSH (or your custom port) before sudo ufw enable.

Verify fail2ban is protecting SSH#

sudo systemctl status fail2ban
sudo fail2ban-client status sshd

On 24.04 and 26.04 the status shows Journal matches: (the sshd journal filter) where 22.04 shows File list: /var/log/auth.log. When a bot hits the limit, the ban appears in the jail's Banned IP list and in the log:

2026-10-25 18:36:11,027 fail2ban.actions        [1997]: NOTICE  [sshd] Ban 203.0.113.42

To test end to end without locking yourself out, ban a documentation address manually and check the firewall:

sudo fail2ban-client set sshd banip 192.0.2.15
sudo nft list table inet f2b-table | grep 192.0.2.15
sudo fail2ban-client set sshd unbanip 192.0.2.15

If something's off, start with fail2ban not banning.

Upgrading Ubuntu with fail2ban installed#

During do-release-upgrade, dpkg may ask about defaults-debian.conf or jail.conf if you edited them. Choose the package maintainer's version — your changes belong in jail.local. After the upgrade, run sudo fail2ban-client -t and check fail2ban-client status sshd, because the default backend and ban action change between 22.04 and 24.04.

FAQ#

How do I install fail2ban on Ubuntu 24.04?#

Run sudo apt update && sudo apt install fail2ban nftables. The service starts automatically with the sshd jail enabled, reading the systemd journal and banning with nftables. Add your own settings in /etc/fail2ban/jail.local, then sudo systemctl restart fail2ban and check sudo fail2ban-client status sshd.

Is fail2ban enabled by default on Ubuntu?#

fail2ban isn't installed by default on Ubuntu Server. Once you install the package, the service is enabled at boot and the sshd jail is turned on by /etc/fail2ban/jail.d/defaults-debian.conf. All other jails stay disabled until you set enabled = true for them.

Why does my nginx jail on Ubuntu 24.04 never ban anything?#

Ubuntu 24.04's defaults-debian.conf sets backend = systemd for all jails, so file-based jails ignore logpath and read the journal instead. Add backend = auto to the nginx (or Apache) jail section in jail.local and reload.

Which fail2ban version does Ubuntu 22.04 have?#

Ubuntu 22.04 ships fail2ban 0.11.2. It uses iptables-multiport bans and reads /var/log/auth.log. It works fine for SSH. For 1.x features such as status --all or sshd-session matching, upgrade to Ubuntu 24.04+ or install a newer release from source.