How to Install Fail2ban: Protect Your Server From Attacks
How to install Fail2ban: block SSH brute-force attacks, configure jail.local, protect Nginx, manage banned IP addresses and use Fail2ban with ufw.
Fail2ban is an open-source tool that watches the log files on your server and automatically blocks IP addresses that make repeated failed login attempts in the firewall for a period of time. Every server exposed to the internet faces automated password-guessing attacks against SSH within minutes of being set up. Fail2ban leaves these attackers outside the door after a few attempts.
This guide covers how Fail2ban works, how to install it on Ubuntu, Debian and AlmaLinux, SSH protection, jail.local settings, Nginx protection and managing banned addresses.
How does Fail2ban work?
Fail2ban is made up of three parts:
- Filter: Regular expressions that recognize a failed login in a log file. For SSH, for example, the "Failed password" lines.
- Action: What to do when an address is caught. Usually this means adding a block rule to the firewall.
- Jail: A definition that brings together a filter, an action and the rules (after how many attempts, for how long). Each service gets its own jail.
If an IP address makes maxretry failed attempts within findtime, it is blocked for bantime. When the time runs out, the ban is lifted on its own.
How to install Fail2ban
Ubuntu and Debian:
sudo apt update
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
AlmaLinux and Rocky Linux (the package is in the EPEL repository):
sudo dnf install epel-release
sudo dnf install fail2ban
sudo systemctl enable --now fail2ban
Check that the service is running:
sudo fail2ban-client status
On the Ubuntu and Debian packages, the SSH jail is enabled by default; if you see sshd in the output, basic protection is already working.
Settings with jail.local
Write your settings not to the jail.conf file that ships with the package, but to an /etc/fail2ban/jail.local file you create yourself. jail.conf can be overwritten during updates; jail.local is preserved and applied on top of it.
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
bantime.increment = true
ignoreip = 127.0.0.1/8 ::1 198.51.100.7
[sshd]
enabled = true
bantime: The ban duration.1hmeans one hour.findtime: The time window in which attempts are counted.maxretry: The maximum number of failed attempts allowed in that window.bantime.increment: Multiplies the ban time each time the same address gets caught again. Very effective against persistent bots.ignoreip: Addresses that will never be banned. Replace198.51.100.7with your own static IP address so you don't lock yourself out by accident.
After applying the settings, restart the service:
sudo systemctl restart fail2ban
A note for Debian 12 and later: On these versions, logs are kept in the systemd journal by default instead of /var/log/auth.log. If the SSH jail doesn't start, add the line backend = systemd to the [sshd] section.
If you changed your SSH port, tell the jail about it; otherwise Fail2ban applies the block to the wrong port:
[sshd]
enabled = true
port = 2222
Managing banned addresses
| Command | What it does |
|---|---|
sudo fail2ban-client status | Lists the active jails |
sudo fail2ban-client status sshd | Shows the banned addresses and counts in the SSH jail |
sudo fail2ban-client set sshd banip 203.0.113.50 | Bans an address manually |
sudo fail2ban-client set sshd unbanip 203.0.113.50 | Lifts the ban on an address |
sudo fail2ban-client unban --all | Lifts all bans |
Fail2ban's own log is in the /var/log/fail2ban.log file; there you can see which address was banned, when and by which jail.
Protecting Nginx and other services
Fail2ban isn't just for SSH. The package ships with ready-made filters for many services; you turn them on by adding them to the jail.local file:
[nginx-http-auth]
enabled = true
[nginx-botsearch]
enabled = true
[recidive]
enabled = true
nginx-http-auth: Catches failed logins to Nginx's password-protected pages.nginx-botsearch: Catches bots that scan for non-existent admin panels and known vulnerabilities.recidive: Watches Fail2ban's own log and blocks addresses that get banned again and again in different jails for much longer.
We covered installing and configuring Nginx in our How to install Nginx guide. There are also ready-made filters for services such as WordPress, Postfix, Dovecot and MariaDB; you can see the list in the /etc/fail2ban/filter.d/ folder.
Using it together with ufw
By default, Fail2ban adds iptables or nftables rules directly and works with ufw without issues. If you want bans to show up as ufw rules, add this to the [DEFAULT] section:
banaction = ufw
From then on you'll also see banned addresses in the sudo ufw status output. We explain how firewalls and ports work in What is a port?
The limits of Fail2ban
Fail2ban is a strong extra layer, but it doesn't solve everything:
- The real protection is strong authentication. Turn off password login for SSH and allow key-based login only; we walk through it step by step in What is SSH?
- It slows down distributed attacks but can't stop them. Thousands of different addresses that each make only a few attempts can stay below Fail2ban's threshold.
- It isn't DDoS protection. Attacks that flood your connection with traffic need protection at the network level; we explain the difference in What is DDoS?
Security on Nodesty servers
On Nodesty AMD Ryzen 9 9950X VPS and AMD EPYC 7763 VPS plans, you can install Fail2ban in minutes with full root access. While Fail2ban stops login attempts inside your server, L3–L7 nShield DDoS protection filters network-level attacks before they reach your server. If you lose SSH access because of a ban, you can always reach your server through the web console in your panel.
Frequently Asked Questions
Do I need Fail2ban if I use SSH keys?
Key-based login already makes password-guessing attacks useless; that is the real protection. Fail2ban is still useful. It reduces the noise in your logs, lowers the resources the server spends answering every attempt and also protects places where keys can't be used, such as Nginx or other services.
Does Fail2ban stop DDoS attacks?
No. Fail2ban reads log files and blocks specific IP addresses; it isn't designed for a DDoS attack that comes from thousands of different addresses and floods your connection. Attacks like that need DDoS protection that works at the network level, in front of the server.
I banned myself by accident. What should I do?
Connect to the server from another IP address, for example your phone's mobile connection, or through your provider's web console, and run the command sudo fail2ban-client set sshd unbanip your-IP-address. To keep it from happening again, add your own static IP address to the ignoreip line.
How long does a ban last?
The default ban time is set by the bantime setting and is usually 10 minutes. One hour, as in this guide, is a good starting point. If you turn on bantime.increment, the ban time for addresses that get caught again and again grows longer each time.
Can Fail2ban and ufw be used together?
Yes. By default Fail2ban blocks with iptables or nftables rules and doesn't conflict with ufw. If you want, the banaction = ufw setting makes bans get added as ufw rules, so you can see banned addresses in the ufw status output.
Should I edit the jail.conf file?
No. jail.conf can be overwritten by package updates. Always write your own settings to the jail.local file or to a separate file in the jail.d folder; Fail2ban applies the settings in these files on top of jail.conf.
About the author
Nodesty Team · Infrastructure & Support
The Nodesty team runs our servers, network and DDoS protection day to day and answers customer support requests around the clock. These guides come from that work.
Related articles
Website Hacked? What to Do, Step by Step
Website hacked? What to do: the signs, first response, passwords, finding malicious files, restoring a clean backup, WordPress cleanup and prevention.
Linux Server Security: A Step-by-Step Checklist
A Linux server security checklist: automatic updates, SSH keys, a firewall, Fail2ban, unneeded services, isolation, backups and security audits.
How to Set Up WireGuard: Run Your Own VPN Server
How to set up WireGuard as your own VPN on an Ubuntu server: generating keys, wg0.conf, IP forwarding and NAT, client settings and QR codes for phones.