# Install and set up fail2ban on Ubuntu

> Install fail2ban on Ubuntu 24.04, 22.04 or 26.04: versions per release, what defaults-debian.conf changes, the sshd jail, UFW integration and how to verify bans.
>
> Source: https://fail2ban.dev/install/ubuntu/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To install fail2ban on Ubuntu, run `sudo apt update && sudo apt install fail2ban`. The package starts the service and enables the `sshd` jail automatically on Ubuntu 22.04, 24.04 and 26.04. Then create `/etc/fail2ban/jail.local` with your `ignoreip` and ban times, run `sudo systemctl restart fail2ban`, and check it with `sudo fail2ban-client status sshd`.

```bash
sudo apt install fail2ban nftables
sudo systemctl status fail2ban
sudo fail2ban-client status sshd
```

## fail2ban version on each Ubuntu release

| Ubuntu release | fail2ban package | Default ban action | sshd reads from |
|---|---|---|---|
| 26.04 LTS "resolute" | 1.1.0 | nftables | systemd journal (`ssh.service`) |
| 25.10 | 1.1.0 | nftables | systemd journal |
| **24.04 LTS "noble"** | **1.0.2** (1.0.2-3ubuntu0.1) | nftables | systemd journal (all jails) |
| 22.04 LTS "jammy" | 0.11.2 | iptables-multiport | `/var/log/auth.log` |
| 20.04 LTS "focal" | 0.11.1 | iptables-multiport | `/var/log/auth.log` |

The latest upstream release is 1.1.1. Ubuntu doesn't backport new fail2ban versions to LTS releases, so 24.04 stays on 1.0.2 with security fixes only. That's fine for SSH protection; if you need a 1.1.x feature, [install from source](/install/).

> **Ubuntu 24.04: "No module named 'asynchat'"**
The original 24.04 package (1.0.2-3) crashed on start because Python 3.12 dropped the `asynchat` module. The fix is in `1.0.2-3ubuntu0.1` from `noble-updates`. If you see this error, run `sudo apt update && sudo apt install --only-upgrade fail2ban`. Don't install `pyasynchat` with pip.

## What defaults-debian.conf changes on Ubuntu

Ubuntu's package adds `/etc/fail2ban/jail.d/defaults-debian.conf`. It's the reason fail2ban "just works" after install, and it's also the source of most Ubuntu-specific surprises. Look at yours:

```bash
```
```ini
[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]
backend = systemd

[sshd]
enabled = true
```
#### Ubuntu 26.04
```ini
[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
backend = systemd
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
enabled = true
```
#### Ubuntu 22.04
```ini
[sshd]
enabled = true
```

Don't edit `defaults-debian.conf` — it's a package file. Override it in `jail.local`, which is read after `jail.d/*.conf`.

## Configure fail2ban on Ubuntu: jail.local for SSH

Create `/etc/fail2ban/jail.local`:

```ini
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10
bantime  = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
bantime.maxtime = 1w

[sshd]
enabled = true
mode = normal
```
- `bantime.increment`: repeat offenders get 1h, 2h, 4h… up to a week. Details in [incremental bans](/config/bantime-increment/).
- If SSH listens on another port, add `port = 2222` to `[sshd]` — otherwise the ban blocks port 22 only.

Test and apply:

```bash
sudo systemctl restart fail2ban
```

Because 24.04 puts `backend = systemd` in `[DEFAULT]`, a jail like `nginx-http-auth` silently ignores its `logpath` and reads the journal instead, where nginx's errors never appear. The jail starts, shows no errors, and never bans anyone. Set the backend back to file monitoring for each file-based jail:

```ini
[nginx-http-auth]
enabled = true
backend = auto
```

## fail2ban and UFW on Ubuntu

UFW and fail2ban work together without extra configuration. Two choices:

**Keep the default nftables action (24.04, 26.04).** fail2ban creates its own `inet f2b-table` table with a chain on the input hook at priority -1, which runs before UFW's rules. A banned IP is rejected even if UFW allows the port. UFW doesn't know about these bans, so `ufw status` won't list them — check with:

```bash
```

```ini
[DEFAULT]
banaction = ufw
banaction_allports = ufw
```

Also remember the basics: `sudo ufw allow OpenSSH` (or your custom port) **before** `sudo ufw enable`.

## Verify fail2ban is protecting SSH

```bash
sudo fail2ban-client status sshd
```

```log
```

```bash
sudo nft list table inet f2b-table | grep 192.0.2.15
sudo fail2ban-client set sshd unbanip 192.0.2.15
```

## Upgrading Ubuntu with fail2ban installed

During `do-release-upgrade`, dpkg may ask about `defaults-debian.conf` or `jail.conf` if you edited them. Choose the package maintainer's version — your changes belong in `jail.local`. After the upgrade, run `sudo fail2ban-client -t` and check `fail2ban-client status sshd`, because the default backend and ban action change between 22.04 and 24.04.

## FAQ

### How do I install fail2ban on Ubuntu 24.04?

Run `sudo apt update && sudo apt install fail2ban nftables`. The service starts automatically with the sshd jail enabled, reading the systemd journal and banning with nftables. Add your own settings in `/etc/fail2ban/jail.local`, then `sudo systemctl restart fail2ban` and check `sudo fail2ban-client status sshd`.

### Is fail2ban enabled by default on Ubuntu?

fail2ban isn't installed by default on Ubuntu Server. Once you install the package, the service is enabled at boot and the sshd jail is turned on by `/etc/fail2ban/jail.d/defaults-debian.conf`. All other jails stay disabled until you set `enabled = true` for them.

### Why does my nginx jail on Ubuntu 24.04 never ban anything?

Ubuntu 24.04's `defaults-debian.conf` sets `backend = systemd` for all jails, so file-based jails ignore `logpath` and read the journal instead. Add `backend = auto` to the nginx (or Apache) jail section in jail.local and reload.

### Which fail2ban version does Ubuntu 22.04 have?

Ubuntu 22.04 ships fail2ban 0.11.2. It uses iptables-multiport bans and reads `/var/log/auth.log`. It works fine for SSH. For 1.x features such as `status --all` or `sshd-session` matching, upgrade to Ubuntu 24.04+ or install a newer release from source.