{"id":720,"date":"2026-07-25T23:45:07","date_gmt":"2026-07-25T23:45:07","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=720"},"modified":"2026-08-04T22:10:35","modified_gmt":"2026-08-04T22:10:35","slug":"how-to-configure-fail2ban-for-vps-security","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","title":{"rendered":"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Expose an SSH port to the internet and the probes start within minutes: dictionaries of usernames, thousands of attempts a day, all logged as failed password entries in auth.log. Blocking them by hand is a losing game, which is exactly what fail2ban automates \u2014 it watches service logs for repeated failures and injects temporary firewall bans against the offending IP. This guide sets up fail2ban on a VPS, tunes the jail for SSH and web services, and shows you how to test it without locking yourself out.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban is a layer on top of your host firewall, so the ruleset from the previous setup should already be in place. It is also worth checking your provider&#8217;s abuse policies first \u2014 some hosts frown on aggressive scanning, and the underlying hardware needs to handle connection tracking for thousands of banned IPs; <a href=\"https:\/\/virtualserversvps.com\/#providers\">compare VPS plans on our comparison table<\/a> to pick a host that gives you full root control over both.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Install and Start the Default Jails<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Install fail2ban from the distribution repositories \u2014 never from random PPAs, since this daemon runs as root:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt update &amp;&amp; apt install -y fail2ban\nsystemctl enable --now fail2ban\nfail2ban-client status          # lists active jails<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Out of the box you get an <code>sshd<\/code> jail with conservative defaults: 5 failures within 10 minutes earns a 10-minute ban. Configuration lives in <code>\/etc\/fail2ban\/jail.local<\/code>, which overrides the packaged <code>jail.conf<\/code> without being clobbered by updates. Start with realistic thresholds \u2014 on a busy server 3 failures can be a flaky client, but 5 is usually malice:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[DEFAULT]\nbantime  = 1h\nfindtime = 10m\nmaxretry = 5\nignoreip = 127.0.0.1\/8 ::1 10.0.0.0\/8\n\n[sshd]\nenabled = true\nbackend = systemd<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>bantime<\/code> can be a duration string like <code>1h<\/code> or <code>7d<\/code>; the <code>recidive<\/code> jail (enabled separately) escalates repeat offenders by watching the main fail2ban log itself and banning for a week. Two settings worth knowing: <code>banaction<\/code> selects the firewall backend \u2014 <code>nftables-multiport<\/code> on modern systems, <code>iptables-multiport<\/code> on older ones \u2014 and must match the firewall you actually run, or bans silently do nothing. <code>backend = systemd<\/code> reads the journal instead of a log file, which is correct on Debian 12 and Ubuntu 22.04+ where sshd logs to the journal. Restart the service after changes: <code>systemctl restart fail2ban<\/code>, and confirm each jail loaded with <code>fail2ban-client status<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Jails Beyond SSH<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SSH is only the beginning. Fail2ban ships with hundreds of filters, and the ones worth enabling on a typical VPS are:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Jail<\/th><th>Protects<\/th><th>Log file<\/th><\/tr><\/thead><tbody><tr><td><code>sshd<\/code><\/td><td>SSH brute force<\/td><td>auth.log (systemd)<\/td><\/tr><tr><td><code>nginx-http-auth<\/code><\/td><td>Basic-auth password guessing<\/td><td>nginx error.log<\/td><\/tr><tr><td><code>nginx-botsearch<\/code><\/td><td>Scanners hitting 404 paths<\/td><td>nginx access.log<\/td><\/tr><tr><td><code>postfix-sasl<\/code><\/td><td>SMTP AUTH brute force<\/td><td>mail.log<\/td><\/tr><tr><td><code>proftpd<\/code> \/ <code>vsftpd<\/code><\/td><td>FTP login attacks<\/td><td>ftp logs<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Enable one, verify its log path actually exists (a wrong path silently disables the jail), then restart. A typical pair for a web server looks like this \u2014 note the custom <code>maxretry<\/code> for the bot jail, since bots are more persistent than humans:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[nginx-botsearch]\nenabled  = true\nlogpath  = \/var\/log\/nginx\/access.log\nmaxretry = 3\nfindtime = 1h\nbantime  = 12h<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you are running this on rented hardware, the ban actions themselves consume a little CPU and memory per banned IP, but nothing that matters until you hit tens of thousands of entries. A VPS with a decent CPU and 2&nbsp;GB of RAM handles that easily \u2014 <a href=\"https:\/\/interserver.net\/vps?id=1067805&amp;sid=virtualserversvps\" rel=\"noreferrer noopener sponsored\" target=\"_blank\">InterServer\u2019s VPS plans include root access and flat-rate pricing<\/a>, so you can tune jails aggressively without worrying about metered abuse charges.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Test It Safely, Then Watch It Work<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Never test a ban from the machine you are sitting on without a fallback. The safe procedure: open a second SSH session, then deliberately trigger failures from another IP (a phone on mobile data works well):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># from the attacking machine: 5 wrong passwords in a row\nssh root@your-vps    # fail 5 times\n\n# back on the VPS:\nfail2ban-client status sshd\n# \"Currently banned: 1\" \u2014 and the IP is in your firewall:\nnft list set inet f2b-sshd   # or: iptables -L f2b-sshd -n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To unban manually: <code>fail2ban-client set sshd unbanip 203.0.113.9<\/code>. To ban immediately for testing: <code>fail2ban-client set sshd banip 203.0.113.9<\/code>. If you ever see legitimate users getting caught, raise <code>maxretry<\/code> or add their IP to <code>ignoreip<\/code> \u2014 a whitelist entry is always better than a support ticket.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two operational notes. First, if your VPS sits behind Cloudflare, ban by <code>X-Forwarded-For<\/code> requires the <code>apache-shared<\/code>-style proxy filter or you will ban Cloudflare&#8217;s edge IPs and take your own site down. Second, monitor the <code>fail2ban.log<\/code> for <code>Ban<\/code>\/<code>Unban<\/code> lines \u2014 a steady stream of bans means your setup is earning its keep. Combined with key-based SSH authentication and a stateful firewall, fail2ban turns passive exposure into an automated defense; for the hardware to run it 24\/7, <a href=\"https:\/\/virtualserversvps.com\/#providers\">see the full specs and pricing on our comparison table<\/a>.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Expose an SSH port to the internet and the probes start within minutes: dictionaries of usernames, thousands of attempts a day, all logged as failed password entries in auth.log. Blocking&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":2,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-720","post","type-post","status-publish","format-standard","hentry","category-security-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically - Virtual Servers VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically\" \/>\n<meta property=\"og:description\" content=\"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-25T23:45:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-04T22:10:35+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\",\"name\":\"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-07-25T23:45:07+00:00\",\"dateModified\":\"2026-08-04T22:10:35+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically - Virtual Servers VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","og_locale":"en_US","og_type":"article","og_title":"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically","og_description":"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically","og_url":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-07-25T23:45:07+00:00","article_modified_time":"2026-08-04T22:10:35+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","url":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/","name":"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-07-25T23:45:07+00:00","dateModified":"2026-08-04T22:10:35+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/how-to-configure-fail2ban-for-vps-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Fail2ban on a VPS: Blocking Brute-Force Attacks Automatically"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=720"}],"version-history":[{"count":3,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/720\/revisions"}],"predecessor-version":[{"id":798,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/720\/revisions\/798"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}