Installing and Configuring fail2ban

What is fail2ban?

fail2ban monitors log files for repeated authentication failures and automatically bans the offending IP addresses using iptables. It works with SSH, Apache, Nginx, FTP, and dozens of other services.

Install fail2ban

apt update && apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

Configure fail2ban

Never edit jail.conf directly — it gets overwritten on upgrades. Use a local override:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local

Key settings in [DEFAULT]:

[DEFAULT]
# How long to ban (10 minutes, 1 hour, 1 day, etc.)
bantime  = 1h
# Time window to count failures
findtime = 10m
# Max failures before ban
maxretry = 5
# IPs to never ban (your home IP, localhost)
ignoreip = 127.0.0.1/8 ::1 YOUR_HOME_IP

SSH Jail Configuration

[sshd]
enabled  = true
port     = ssh
logpath  = /var/log/auth.log
maxretry = 3
bantime  = 24h

Nginx Protection

[nginx-http-auth]
enabled  = true
port     = http,https
logpath  = /var/log/nginx/error.log
maxretry = 5

[nginx-limit-req]
enabled  = true
port     = http,https
logpath  = /var/log/nginx/error.log
maxretry = 10

Apply and Check Status

systemctl restart fail2ban
fail2ban-client status
fail2ban-client status sshd

Unban an IP

fail2ban-client set sshd unbanip 1.2.3.4

View Banned IPs

fail2ban-client banned