# fail2ban jail.local generator

> Free fail2ban jail.local generator. Pick your distro, firewall and services, set bantime, findtime, maxretry and ignoreip, and copy a clean, commented config.
>
> Source: https://fail2ban.dev/tools/jail-generator/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

## What the generator writes

The output is a normal `jail.local`. fail2ban reads it after `jail.conf` and the files in `jail.d/`, so anything here wins — see [how fail2ban loads its configuration](/config/). The generator keeps it short on purpose:

- **`[DEFAULT]`** holds your ban policy: `ignoreip`, `bantime`, `findtime`, `maxretry`, optional [incremental bans](/config/bantime-increment/) and, if you chose one, the [`banaction`](/config/banaction/). On Debian 12/13, Ubuntu 24.04+ and Arch it sets `backend = systemd`, because those systems log SSH to the journal.
- **One section per service** with `enabled = true`. Ports, log paths, filters and actions come from the stock `[jail]` definitions in `jail.conf` — which are kept up to date with each fail2ban release — so the file stays valid when fail2ban changes a log path.
- **Exceptions are explicit.** Services that write their own log file (nginx, Apache, FTP servers) get `backend = auto` so they read the file even when the default backend is the journal. `[recidive]` reads `/var/log/fail2ban.log`.
- **Docker.** With iptables the bans go into the `DOCKER-USER` chain (and stay in `INPUT` for SSH); with nftables, container jails ban in the `forward` hook on all ports. The background is in [protecting Docker containers](/guides/docker/).

## Install the file

```bash
sudo fail2ban-client -t                  # test the configuration
sudo fail2ban-client reload
sudo fail2ban-client status
```

## Choosing the values

| Setting | Generator default | Why |
|---|---|---|
| `bantime` | `1h` | Long enough to stop a scripted attack, short enough that a locked-out user recovers. |
| `findtime` | `10m` | The stock default; failures older than this are forgotten. |
| `maxretry` | `5` | Real users rarely mistype a password five times in ten minutes. |
| `bantime.increment` | on, factor 1, max `1w` | Each new ban of the same IP lasts twice as long: 1h, 2h, 4h, 8h… up to a week. |
| `ignoreip` | `127.0.0.1/8 ::1` | Add your own public IP, VPN and LAN so you never ban yourself. |

How long the incremental bans get is easier to see than to calculate — try the [bantime calculator](/tools/bantime-calculator/). Every option is explained in the [jail options reference](/config/jail-options/), and a fully commented production file is on the [jail.local example](/config/jail-local/) page.

## FAQ

### Is the generated jail.local safe to use as-is?

It only enables stock jails and overrides a few values, so it is a sound starting point — but test it with `sudo fail2ban-client -t` and check each jail with `sudo fail2ban-client status <jail>`. Make sure your own IP is in the `ignoreip` field before you reload.

### Why does the generator set backend = auto on some jails?

On Debian 12/13, Ubuntu 24.04+ and Arch the default backend is the systemd journal. Services such as nginx, Apache and FTP servers write their own log files, and with `backend = systemd` fail2ban would ignore their `logpath`. `backend = auto` makes those jails read the file.

### Can I add a service that isn't in the list?

Yes — add a section by hand with `enabled = true`, `filter`, `port` and `logpath`. Check the [filter library](/filters/) for a built-in filter first; if there isn't one, the [filter generator](/tools/filter-generator/) writes one from a log line.

### Does the tool send my settings anywhere?

No. The generator runs entirely in your browser; nothing you type leaves the page.