If you run a Linux server with SSH enabled, you have probably noticed something in your auth logs: hundreds, sometimes thousands, of failed login attempts from random IP addresses. These are automated bots scanning the internet for weak passwords and open SSH ports.
Fail2ban is one of the most effective tools for dealing with this problem. It monitors your logs, detects suspicious behavior, and automatically blocks the IPs trying to break in. I use it on every server I manage, and in this guide, I will walk you through installing and configuring it from scratch.
What Fail2ban Actually Does
Fail2ban watches log files (like /var/log/auth.log for SSH) for patterns that indicate attacks. When it sees too many failed login attempts from the same IP address, it updates your firewall rules to block that IP for a set period of time.
The default configuration is conservative: 3 failed attempts in 10 minutes gets you banned for 10 minutes. But you can make it much stricter. I typically set it to ban IPs for 24 hours after 5 failed attempts, which is aggressive enough to stop most automated attacks without being too restrictive.
Step 1: Install Fail2ban
First, update your system and install Fail2ban from the package manager:
sudo apt update && sudo apt upgrade
sudo apt install fail2ban
Fail2ban starts automatically after installation, but it runs with default settings that are not ideal for production use. Let's fix that.
Step 2: Create a Local Configuration File
Fail2ban ships with /etc/fail2ban/jail.conf, which contains all the default settings. Never edit this file directly because package updates will overwrite your changes. Instead, create a local copy:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
Now you can customize settings in jail.local without worrying about updates breaking your configuration.
Step 3: Configure Global Settings
Open jail.local and look for the [DEFAULT] section near the top. Here are the settings I recommend:
[DEFAULT]
# Ban IPs for 24 hours (default is 10 minutes)
bantime = 86400
# Ban after 5 failed attempts (default is 3)
maxretry = 5
# Check the last 10 minutes of logs (default is 10 minutes)
findtime = 600
# Whitelist trusted IPs (your local network and localhost)
ignoreip = 127.0.0.1/8 192.168.1.0/24
The ignoreip line is important. You never want to accidentally ban yourself. Replace 192.168.1.0/24 with your actual local network range. You can check this by running ip addr show and looking at your network interface.
Step 4: Enable SSH Protection
Scroll down to the [sshd] section and make sure it looks like this:
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 5
bantime = 86400
If you changed your SSH port from the default 22, update the port line to match. For example, if your SSH runs on port 2222:
port = 2222
Step 5: Restart Fail2ban and Verify
After saving your changes, restart the service:
sudo systemctl restart fail2ban
Now check if Fail2ban is running and monitoring SSH:
sudo fail2ban-client status
You should see output like this:
Status
|- Number of jail: 1
`- Jail list: sshd
To see details about the SSH jail specifically:
sudo fail2ban-client status sshd
This shows you how many IPs are currently banned, total bans, and other statistics.
Step 6: Check the Logs
Fail2ban writes its own log file at /var/log/fail2ban.log. Check it to see what's happening:
sudo tail -n 20 /var/log/fail2ban.log
You should see entries like "Ban" when Fail2ban blocks an IP and "Unban" when the ban expires. If you don't see any activity, your server might not be getting attacked yet, or the attacks are coming from IPs in your whitelist.
How to Test If Fail2ban Is Working
You can simulate an attack to verify Fail2ban is working correctly. From a different machine (or a VM), try logging into your server with the wrong password 5 times:
ssh haider@your-server-ip
# Enter wrong password 5 times
After the 5th failed attempt, try again and you should get a connection timeout or "Connection refused" error. Check the Fail2ban status to confirm:
sudo fail2ban-client status sshd
You should see your test IP in the "Currently banned" list. To unban it manually:
sudo fail2ban-client set sshd unbanip YOUR_IP_ADDRESS
Protecting Other Services
Fail2ban can protect more than just SSH. It comes with filters for common services like:
- Nginx/Apache: Block IPs making too many 404 requests or attempting directory traversal
- Postfix/Dovecot: Protect email servers from brute-force attacks
- WordPress: Block IPs trying to brute-force wp-login.php
- Nextcloud: Protect your self-hosted cloud from unauthorized access
To enable additional jails, add them to jail.local. For example, to protect Nginx:
[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
Unbanning IPs Manually
Sometimes you need to unban an IP that got blocked by mistake. Use this command:
sudo fail2ban-client set JAIL_NAME unbanip IP_ADDRESS
For example, to unban an IP from the SSH jail:
sudo fail2ban-client set sshd unbanip 192.168.1.100
Why Fail2ban Matters
Automated bots scan the internet 24/7 looking for vulnerable servers. Without Fail2ban, your auth logs fill up with thousands of failed login attempts per day. With Fail2ban, those IPs get blocked after a few tries, reducing noise in your logs and making your server significantly harder to compromise.
Fail2ban is not a replacement for strong passwords, SSH keys, or disabling password authentication entirely. But it is an excellent additional layer of defense that costs nothing and takes 10 minutes to set up.
Common Questions
Does Fail2ban work with IPv6? Yes, Fail2ban supports IPv6 out of the box. It will ban both IPv4 and IPv6 addresses that trigger your rules.
Will Fail2ban slow down my server? No. Fail2ban runs as a lightweight daemon and only processes log files. The performance impact is negligible, even on low-resource servers.
Can I use Fail2ban with firewalld instead of iptables?
Yes. If you're using firewalld (common on RHEL/CentOS/Fedora), add banaction = firewallcmd-ipset to your [DEFAULT] section in jail.local.
What if I get locked out?
If you accidentally ban yourself, you can access the server console directly (if it's a VPS, use the web console; if it's physical, plug in a monitor). Then run sudo fail2ban-client set sshd unbanip YOUR_IP to unban yourself. This is why the ignoreip whitelist is so important.
How do I see all banned IPs across all jails?
Run sudo fail2ban-client banned to see a list of all currently banned IPs across all enabled jails.
Final Thoughts
Fail2ban is one of the simplest and most effective security tools you can add to your Linux server. It takes 10 minutes to set up and immediately reduces the attack surface by blocking automated brute-force attempts.
Combine it with strong passwords, SSH keys, and disabling password authentication, and you will have a server that is significantly harder to compromise. For more security tools, check out my guide on free privacy and security checks you can run today.
If you run a public-facing Linux server, Fail2ban should be one of the first things you install after initial setup. It's lightweight, effective, and requires almost no maintenance once configured. For a broader look at cybersecurity basics, you might also want to read what is cybersecurity and how to stay safe online.