Tools

fail2ban jail.local generator

Choose your system and the services you run; the generator writes a commented /etc/fail2ban/jail.local that follows the stock jail definitions and only overrides what it must.

Updated 3 min readChecked against fail2ban 1.1.1
1 · Your system
2 · Ban policy

Add the public IP you connect from. Separate entries with spaces; CIDR ranges and hostnames work.

3 · Services to protect
4 · Notifications
/etc/fail2ban/jail.local

What the generator writes#

The output is a normal jail.local. fail2ban reads it after jail.conf and the files in jail.d/, so anything here wins — see how fail2ban loads its configuration. The generator keeps it short on purpose:

  • [DEFAULT] holds your ban policy: ignoreip, bantime, findtime, maxretry, optional incremental bans and, if you chose one, the banaction. On Debian 12/13, Ubuntu 24.04+ and Arch it sets backend = systemd, because those systems log SSH to the journal.
  • One section per service with enabled = true. Ports, log paths, filters and actions come from the stock [jail] definitions in jail.conf — which are kept up to date with each fail2ban release — so the file stays valid when fail2ban changes a log path.
  • Exceptions are explicit. Services that write their own log file (nginx, Apache, FTP servers) get backend = auto so they read the file even when the default backend is the journal. [recidive] reads /var/log/fail2ban.log.
  • Docker. With iptables the bans go into the DOCKER-USER chain (and stay in INPUT for SSH); with nftables, container jails ban in the forward hook on all ports. The background is in protecting Docker containers.

Install the file#

bash
sudo nano /etc/fail2ban/jail.local       # paste the generated config
sudo fail2ban-client -t                  # test the configuration
sudo fail2ban-client reload
sudo fail2ban-client status

fail2ban-client -t parses every file and reports errors without touching the running server. If a jail fails with "Have not found any log file", the service isn't installed or logs somewhere else — see no log file found for jail.

Choosing the values#

Setting Generator default Why
bantime 1h Long enough to stop a scripted attack, short enough that a locked-out user recovers.
findtime 10m The stock default; failures older than this are forgotten.
maxretry 5 Real users rarely mistype a password five times in ten minutes.
bantime.increment on, factor 1, max 1w Each new ban of the same IP lasts twice as long: 1h, 2h, 4h, 8h… up to a week.
ignoreip 127.0.0.1/8 ::1 Add your own public IP, VPN and LAN so you never ban yourself.

How long the incremental bans get is easier to see than to calculate — try the bantime calculator. Every option is explained in the jail options reference, and a fully commented production file is on the jail.local example page.

FAQ#

Is the generated jail.local safe to use as-is?#

It only enables stock jails and overrides a few values, so it is a sound starting point — but test it with sudo fail2ban-client -t and check each jail with sudo fail2ban-client status <jail>. Make sure your own IP is in the ignoreip field before you reload.

Why does the generator set backend = auto on some jails?#

On Debian 12/13, Ubuntu 24.04+ and Arch the default backend is the systemd journal. Services such as nginx, Apache and FTP servers write their own log files, and with backend = systemd fail2ban would ignore their logpath. backend = auto makes those jails read the file.

Can I add a service that isn't in the list?#

Yes — add a section by hand with enabled = true, filter, port and logpath. Check the filter library for a built-in filter first; if there isn't one, the filter generator writes one from a log line.

Does the tool send my settings anywhere?#

No. The generator runs entirely in your browser; nothing you type leaves the page.

jail.local exampleA complete fail2ban jail.local example for SSH, nginx and recidive, explained line by line, plus a minimal version, distro notes and how to add a custom jail.Jail options referenceReference for every fail2ban jail option: enabled, logpath, backend, port, banaction, bantime, ignoreip, usedns and more, with type, default and an example.Incremental bansMake fail2ban ban repeat offenders longer each time with bantime.increment: every option, the formula vs multipliers, maxtime, and how dbpurgeage limits memory.Whitelist IPs (ignoreip)Whitelist IPs in fail2ban with ignoreip: single IPs, subnets, your LAN, hostnames, dynamic IPs, file: lists, ignorecommand, and why ignoreip seems ignored.Bantime calculatorFree fail2ban bantime calculator: convert values like 1d12h, 1w or 1mo to seconds, and see how long each repeat ban lasts with your bantime.increment settings.

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.