Tools

fail2ban-client command builder

Pick a task, type the jail and IP, and copy the exact fail2ban-client command — with sudo, or wrapped in docker exec if fail2ban runs in a container.

Updated Checked against fail2ban 1.1.1
bash

What it covers#

The builder knows the everyday tasks — unbanning, banning, listing bans with their expiry, runtime whitelisting, reading and changing jail settings, reloads and config tests — and explains what each command prints. The complete list of 96 client commands is in the fail2ban-client reference, and the printable cheat sheet fits the essentials on one page.

Jail names#

Commands take the jail name — the section name in jail.local ([sshd], [nginx-http-auth]) — not the filter file. sudo fail2ban-client status lists the jails that are running. If you get Sorry but the jail 'x' does not exist, the jail isn't enabled or the name is misspelt.

Running fail2ban in Docker#

When fail2ban runs in a container (for example crazymax/fail2ban or linuxserver/fail2ban), the client lives inside it. Tick the Docker option and the builder prefixes the command with docker exec <container>. With Docker Compose you can also use docker compose exec fail2ban fail2ban-client status. See fail2ban in Docker.

FAQ#

What does fail2ban-client print after unbanip or banip?#

A number: how many addresses were actually unbanned or banned. 0 after unbanip means the IP wasn't banned in that jail.

fail2ban-client commandsEvery fail2ban-client command with syntax, options and real output: status, ban, unban, reload, get and set at runtime, plus the complete command list.Cheat sheetPrintable fail2ban cheat sheet: service control, status, ban and unban, ignoreip, runtime get/set, logs, fail2ban-regex tests, file paths, time units and jail.local.Unban an IPUnban an IP in fail2ban with fail2ban-client: from one jail, from all jails, unban everything, IPv6 and Docker, and stop the same IP getting banned again.List banned IPsList banned IPs in fail2ban: status <jail>, banned, get banip --with-time, all jails at once, check one IP, and read bans from nftables, iptables or the database.fail2ban statusCheck fail2ban status with systemctl and fail2ban-client status sshd, and what Currently failed, Total failed, Currently banned and Total banned really mean.

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.