How to install Fail2Ban on Ubuntu

If you check your server logs, you might be surprised how often random IPs try to guess your SSH password. Fail2Ban watches those logs and automatically blocks IPs that make too many failed attempts.

It is a simple tool that makes a big difference in server security. Here is how to set it up.

Step 1: Install Fail2Ban

Ubuntu has Fail2Ban in its default repositories, so installation is straightforward:

sudo apt update
sudo apt install fail2ban -y

Step 2: Understand the config files

Fail2Ban uses two types of configuration files:

• /etc/fail2ban/jail.conf - the default config (do not edit this one directly)

• /etc/fail2ban/jail.local - your custom config (this overrides the defaults)

Create your local config by copying the default:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Or start fresh with just the settings you need:

sudo nano /etc/fail2ban/jail.local

Step 3: Basic SSH protection

Here is a solid starting configuration. Paste this into jail.local:

[DEFAULT]
# Ban IPs for 24 hours after 5 failed attempts
bantime = 24h
maxretry = 5
findtime = 10m

# Send email alerts (optional)
# destemail = [e-mail]
# action = %(action_mw)s

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s

This monitors SSH login attempts. If someone fails 5 times within 10 minutes, they get blocked for 24 hours.

Step 4: Start and enable Fail2Ban

sudo systemctl start fail2ban
sudo systemctl enable fail2ban
sudo systemctl status fail2ban

Step 5: Check what Fail2Ban is doing

See the status for SSH protection:

sudo fail2ban-client status sshd

The output shows how many times the jail has triggered and which IPs are currently banned.

List all active jails:

sudo fail2ban-client status

Step 6: Protect additional services

Fail2Ban comes with built-in filters for many popular services. Enable them by adding to jail.local:

[nginx-http-auth]
enabled = true
logpath = /var/log/nginx/error.log

[nginx-botsearch]
enabled = true
logpath = /var/log/nginx/access.log

[postfix]
enabled = true
logpath = /var/log/mail.log

After changing the config, apply it:

sudo systemctl restart fail2ban

Unbanning an IP

If you accidentally block yourself or want to release a blocked IP:

sudo fail2ban-client set sshd unbanip 203.0.113.4

To unban across all jails:

sudo fail2ban-client unban 203.0.113.4

Whitelisting trusted IPs

If you have a static IP that should never be blocked (like your office or home), add it to the config:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.4

Custom ban actions

By default, Fail2Ban just adds an iptables rule to block the IP. But you can do more:

• Send an email alert

• Run a custom script

• Block the IP in Cloudflare as well

Here is an example that sends email alerts:

[DEFAULT]
destemail = [e-mail]
action = %(action_mw)s

The %(action_mw)s action bans the IP and sends you an email with the whois info.

Viewing logs

If something seems off, check the Fail2Ban logs:

sudo tail -f /var/log/fail2ban.log

Testing that it works

From a different machine, try to SSH into your server with the wrong password a few times. After 5 failed attempts, run this on your server:

sudo fail2ban-client status sshd

You should see the IP listed as banned.

Common questions

How long should I ban IPs for? 24 hours is a reasonable default. For aggressive protection, use 1 week or even permanent bans. Keep in mind that some bots rotate IPs regularly.

Does Fail2Ban use a lot of resources? No. It runs as a lightweight daemon and only scans log files for new entries. You will not notice it on even a small VPS.

What if I reboot? The iptables rules are lost on reboot, but Fail2Ban restores them automatically when it starts back up.

Conclusion

Fail2Ban is one of those set-it-and-forget-it tools. Spend ten minutes configuring it now, and it will block thousands of unwanted login attempts over the lifetime of your server.