Sitemap
Get started
- What is fail2ban?
- How fail2ban works
- Install fail2ban
- Ubuntu
- Debian & Raspberry Pi OS
- Rocky, Alma, RHEL & Fedora
- Arch Linux
- Best practices
Commands
- fail2ban-client commands
- Cheat sheet
- Unban an IP
- Ban an IP manually
- List banned IPs
- fail2ban status
- Restart and reload
- Logs and log location
- fail2ban-regex
Configuration
- Configuration overview
- jail.local example
- Jail options reference
- bantime, findtime, maxretry
- Incremental bans
- Repeat offenders (recidive)
- Whitelist IPs (ignoreip)
- Email alerts
- Ban actions (banaction)
- Backends & systemd journal
- fail2ban.conf / fail2ban.local
Filters & actions
- Filter library
- Mail & webmail filters
- Web app & panel filters
- FTP server filters
- Network & system filters
- Write a custom filter
- Action library
- Write a custom action
Guides
- All guides
- SSH
- Nginx
- Apache
- Nginx Proxy Manager
- Traefik
- Caddy
- Cloudflare
- Docker
- WordPress
- Nextcloud
- Vaultwarden
- Jellyfin
- Home Assistant
- Postfix & Dovecot
- Proxmox VE
- OpenWrt routers
- OpenVPN
- WireGuard
- Asterisk & FreePBX
- Gitea & Forgejo
- MySQL & MariaDB
- Minecraft servers
- UFW
- nftables
- firewalld
- iptables & ipset
- AbuseIPDB reporting
- Monitoring & dashboards
Tools
- All tools
- fail2ban regex tester
- Filter generator
- jail.local generator
- Bantime calculator
- Log analyzer
- Command builder
Troubleshooting
- All problems
- Not banning or not blocking
- No log file found for jail
- Failed to access socket / server
- Exit code 255 / service failed
- Bans the proxy or 127.0.0.1
- Config and regex errors
- High CPU or memory
Compare
- fail2ban alternatives
- fail2ban vs CrowdSec
- fail2ban vs SSHGuard
- fail2ban vs DenyHosts
- fail2ban vs CSF/LFD
- fail2ban vs reaction
- fail2ban vs WAF / ModSecurity
- fail2ban for Windows
Reference
Every built-in filter
- 3proxy
- apache-auth
- apache-badbots
- apache-botsearch
- apache-fakegooglebot
- apache-modsecurity
- apache-nohome
- apache-noscript
- apache-overflows
- apache-pass
- apache-shellshock
- assp
- asterisk
- bitwarden
- centreon
- counter-strike
- courier-auth
- courier-smtp
- cyrus-imap
- dante
- directadmin
- domino-smtp
- dovecot
- dropbear
- drupal-auth
- ejabberd-auth
- exim
- exim-spam
- freeswitch
- froxlor-auth
- gitlab
- grafana
- groupoffice
- gssftpd
- guacamole
- haproxy-http-auth
- horde
- kerio
- lighttpd-auth
- mongodb-auth
- monit
- monitorix
- mssql-auth
- murmur
- mysqld-auth
- nagios
- named-refused
- nginx-bad-request
- nginx-botsearch
- nginx-forbidden
- nginx-http-auth
- nginx-limit-req
- nsd
- openhab
- openvpn
- openwebmail
- oracleims
- pam-generic
- perdition
- php-url-fopen
- phpmyadmin-syslog
- portsentry
- postfix
- proftpd
- proxmox
- pure-ftpd
- qmail
- recidive
- roundcube-auth
- routeros-auth
- scanlogd
- screensharingd
- selinux-ssh
- sendmail-auth
- sendmail-reject
- sieve
- slapd
- softethervpn
- sogo-auth
- solid-pop3d
- squid
- squirrelmail
- sshd
- stunnel
- suhosin
- tine20
- traefik-auth
- uwimap-auth
- vaultwarden
- vsftpd
- webmin-auth
- wuftpd
- xinetd-fail
- xrdp
- znc-adminlog
- zoneminder
Every built-in action
- abuseipdb
- apf
- apprise
- blocklist_de
- bsd-ipfw
- cloudflare
- cloudflare-token
- complain
- csf
- dshield
- dummy
- firewallcmd-allports
- firewallcmd-common
- firewallcmd-ipset
- firewallcmd-multiport
- firewallcmd-new
- firewallcmd-rich-logging
- firewallcmd-rich-rules
- helpers-common
- hostsdeny
- ipfilter
- ipfw
- iptables
- iptables-allports
- iptables-ipset
- iptables-ipset-proto4
- iptables-ipset-proto6
- iptables-ipset-proto6-allports
- iptables-multiport
- iptables-multiport-log
- iptables-new
- iptables-xt_recent-echo
- ipthreat
- mail-buffered
- mail-whois
- mail-whois-common
- mail-whois-lines
- mikrotik
- mynetwatchman
- netscaler
- nftables
- nftables-allports
- nftables-multiport
- nginx-block-map
- npf
- nsupdate
- osx-afctl
- osx-ipfw
- pf
- route
- sendmail
- sendmail-buffered
- sendmail-common
- sendmail-geoip-lines
- sendmail-whois
- sendmail-whois-ipjailmatches
- sendmail-whois-ipmatches
- sendmail-whois-lines
- sendmail-whois-matches
- shorewall
- shorewall-ipset-proto6
- smtp
- symbiosis-blacklist-allports
- ufw
- xarf-login-attack
About this site
Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.