fail2ban bantime calculator

How the calculator works#

The converter is a port of fail2ban's own str2seconds parser, so it reads values exactly as fail2ban does: 1d12h, 1h 30m, 36h, 1y-6mo, plain seconds, and -1 for a permanent ban. Watch out for m — it means minutes; a month is mo. The full list of units, common values and what -1 and 0 mean is on the bantime, findtime and maxretry page.

The simulator reproduces the code fail2ban 1.1.1 runs when bantime.increment = true:

• ban #1 is always the plain bantime;
• each later ban is bantime × 2^n × bantime.factor (or bantime × factor × multiplier[n] when you set bantime.multipliers);
• bantime.maxtime caps the result and bantime.rndtime adds up to that much random time;
• the last column shows how long fail2ban keeps the IP's record before it forgets it: 3 × the last ban length + dbpurgeage. An IP that returns after that starts again at ban #1.

Why the formula works this way, how bantime.overalljails counts bans across jails and which values to pick is explained in incremental bans. Copy the generated block into jail.local, or build a complete config with the jail.local generator.

FAQ#

Why does ban #2 last four times the bantime with factor 2?#

Because the default formula multiplies by both 2^n and the factor: with bantime = 1h and bantime.factor = 2, ban #2 is 1h × 2 × 2 = 4h, ban #3 is 8h, ban #4 16h. Use factor = 1 if you want plain doubling (1h, 2h, 4h…).

Why does the simulator stop growing at a certain ban?#

That's bantime.maxtime: no ban can be longer. Clear the field to see uncapped values — they grow quickly, so a cap of a week or a month is normal.

Is 1mo exactly 30 days?#

No. fail2ban defines a month as a year divided by 12, using 365.25-day years: 2,629,800 seconds, about 30.44 days. A year (1y) is 31,557,600 seconds.

Why do my real bans not match the table?#

Usually because the database forgot the IP: with the default dbpurgeage = 1d the record of a one-hour ban is deleted about a day after the ban, so the next ban counts as #1 again. A random bantime.rndtime also changes every ban slightly.