# fail2ban configuration and regex errors

> Fix fail2ban errors: No failure-id group in, No section: 'Definition', jail does not exist, nft or iptables not found, and the allowipv6 not defined warning.
>
> Source: https://fail2ban.dev/troubleshooting/config-errors/ · Updated 2026-10-26 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

Most fail2ban configuration errors show up when you run `sudo fail2ban-client -t`, which tests every file and prints `OK: configuration test is successful` or the error and `ERROR: test configuration failed`. Find your message below. The most common ones are a custom `failregex` without `<HOST>` (`No failure-id group in`), a filter file without a `[Definition]` header, a misspelled filter name, and a ban action whose firewall command (`nft` or `iptables`) isn't installed. The `'allowipv6' not defined` line on Debian 12 and Ubuntu 24.04 is a harmless warning, not an error.

```bash
sudo grep -E "ERROR|WARNING" /var/log/fail2ban.log | tail -20
```

```text
```

**Fix:** add the address tag where the IP appears in the log line:

```ini
[Definition]
failregex = ^Login failed for user \S+ from <HOST>$
```

```bash
```

## No section: 'Definition'

```text
```

**Fix:** every filter and action file needs the header above its options:

```ini
[Definition]
failregex = ^Login failed for user \S+ from <HOST>$
ignoreregex =
```

```text
ERROR   Unable to read the filter 'myapp'
ERROR   Errors in jail 'myapp'. Skipping...
```

**Fix:** check the name against `ls /etc/fail2ban/filter.d/`, and set `filter = <name>` in the jail. The matching error for actions is `Unable to read action 'name'`; check `ls /etc/fail2ban/action.d/`. The [filter library](/filters/) lists every bundled filter.

## Errors in jail '…'. Skipping...

```text
```

## Sorry but the jail '…' does not exist

```text
$ sudo fail2ban-client status sshdx
... ERROR   NOK: ('sshdx',)
Sorry but the jail 'sshdx' does not exist
```

**Fix:** list the jails that really exist with `sudo fail2ban-client status`. Jail names are the `[section]` names from `jail.local`, not filter file names. If the jail is missing, enable it, run `sudo fail2ban-client -t`, then `sudo fail2ban-client reload`. If it's enabled but still missing, search the log for `Errors in jail`.

## ERROR NOK: (…)

`NOK` means the server rejected a command and returned the exception text in parentheses. The part inside is the real message:

- `NOK: ("Failed to initialize any backend for Jail 'sshd'",)`: the backend's Python module is missing (`python3-systemd` for `backend = systemd`). See [no log file / backend errors](/troubleshooting/no-log-file/).
- `NOK: ("not banned: ['10.9.9.9']",)`: `unbanip --report-absent` for an address that isn't banned.
- `NOK: ('sshdx',)`: unknown jail, as above.

## nft: not found or iptables: not found

```text
... -- returned 127
... HINT on 127: "Command not found".  Make sure that all commands in ... are in the PATH of fail2ban-server process ...
... ERROR   Failed to execute ban jail 'sshd' action 'nftables' info '...': Error starting action Jail('sshd')/nftables: 'Script error'
```

**Cause:** the ban action calls a firewall tool that isn't installed or isn't in the server's `PATH`. Return code 127 always means "command not found". Firewall actions start on demand, so the error appears at the **first ban**, not at startup. Typical cases:

- Debian 12's fail2ban 1.0.2 defaults to `iptables-multiport`, but minimal installs may have only `nft`.
- Newer packages default to `nftables`, but the `nftables` package was removed or never installed (some container images).

**Fix:** install the tool, or switch the action to the firewall you actually use:

```bash
```
[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]
```

## Interpolation errors (%(var)s and %)

```text
Bad value substitution: option 'action' in section 'sshd' contains an interpolation key 'destemail' which is not a valid option name. Raw value: '...'
```

- **A literal `%`** in a value, such as a URL-encoded string, a password or a date format in a regex, must be written as `%%`.
- **`%(name)s` pointing to nothing:** the referenced option isn't defined in that section or in `[DEFAULT]`. Check the spelling, or define it (for example `destemail = admin@example.com` in `[DEFAULT]`).

## Duplicate options and sections

```text
While reading from '/etc/fail2ban/jail.local' [line 20]: section 'sshd' already exists
```

## File contains no section headers

```text
file: '/etc/fail2ban/jail.local', line: 1
```

## Invalid filter or action definition

```text
```

## Unable to compile regular expression

```text
missing ), unterminated subpattern at position ...
```

## A regex that's valid but hangs (catastrophic backtracking)

No error is printed. Instead fail2ban pins a CPU core and the jail stops processing lines. Nested quantifiers like `(.+)+` or several `.*` in a row can backtrack exponentially on long lines. fail2ban 1.1.1 fixed such patterns in the bundled `dovecot` and `domino-smtp` filters (GHSA-33wh-ccjc-p397). See [high CPU](/troubleshooting/high-cpu/) for how to spot and fix it.

## 'allowipv6' not defined in 'Definition'. Using default one: 'auto'

```text
```

**Cause:** when fail2ban reads `fail2ban.conf` and `fail2ban.local`, it looks up a fixed list of `[Definition]` options. `allowipv6` was added in 1.0.1, but the stock `fail2ban.conf` only has it commented out (`#allowipv6 = auto`). fail2ban 1.0.1 and 1.0.2 log every missing option with a default at **WARNING** level, so each start, `reload`, `fail2ban-client -t` and `-d` prints this line, also in `journalctl -u fail2ban` and [`/var/log/fail2ban.log`](/logs/). From 1.1.0 on the same message is logged at DEBUG level, so it disappears after an upgrade.

| fail2ban version | Typical distributions | Warning? |
|---|---|---|
| 0.11.x | Ubuntu 22.04, Debian 11 | No (option doesn't exist) |
| 1.0.1, 1.0.2 | **Debian 12**, **Ubuntu 24.04**, EPEL 8 | **Yes** |
| 1.1.0, 1.1.1 | Debian 13, Ubuntu 25.10/26.04, Fedora, EPEL 9/10 | No (DEBUG level only) |

**Fix:** define the option in a `.local` file. Don't edit `fail2ban.conf`, because package upgrades replace it.

```bash
sudo fail2ban-client -t
sudo fail2ban-client reload
```

**What allowipv6 does:** it only controls whether fail2ban uses IPv6 **when resolving host names**: DNS names in `ignoreip`, host names in logs with `usedns`, and the server's own addresses for `ignoreself`. `auto` (default) detects IPv6 support; 1.1.0+ checks `/proc/sys/net/ipv6/conf/all/disable_ipv6` first, then the interface addresses. `yes`/`on`/`true`/`1` always resolves IPv6, `no`/`off`/`false`/`0` resolves IPv4 only. It doesn't stop IPv6 addresses found in logs from being banned; that's up to the [ban action](/config/banaction/).

## FAQ

### What does "No failure-id group in" mean in fail2ban?

Your `failregex` doesn't capture who failed. Every failregex needs `<HOST>` (or `<ADDR>`, `<IP4>`, `<IP6>`, `<DNS>`, or an `<F-ID>` group) at the place where the address appears in the log line. Add it, then test with `fail2ban-regex` before reloading.

### How do I fix "No section: 'Definition'"?

Add a `[Definition]` line at the top of the filter or action file, above `failregex`, `actionban` and the other options. The section name is case-sensitive. Files in `filter.d/` and `action.d/` always need it, including `.local` override files.

### Why does fail2ban say the jail does not exist?

The running server has no jail by that name. It's either misspelled, not enabled with `enabled = true`, or skipped because of a config error. `sudo fail2ban-client status` lists the jails that exist, and `/var/log/fail2ban.log` shows `Errors in jail` lines for skipped ones.

### What does "returned 127" mean in fail2ban?

Exit code 127 means a command in the action wasn't found. Usually `nft`, `iptables`, `ipset`, `firewall-cmd`, `ufw`, `sendmail` or `curl` isn't installed or isn't in the server's `PATH`. Install it or switch the jail to an action whose tools you have.

### How do I check fail2ban config for errors?

Run `sudo fail2ban-client -t`. It parses every configuration file, builds all enabled jails, and either prints `OK: configuration test is successful` or the errors followed by `ERROR: test configuration failed`. Run it before every reload.

### Is "allowipv6 not defined in Definition" an error?

No. fail2ban 1.0.1 and 1.0.2 print this warning because `fail2ban.conf` ships with the option commented out, then use the default `auto` and work normally. Add `allowipv6 = auto` under `[Definition]` in `/etc/fail2ban/fail2ban.local` to silence it. fail2ban 1.1.0 and later log it at DEBUG level only.