Fail2ban is an intrusion prevention tool that monitors log files for brute-force login attempts and automatically bans offending IP addresses using firewall rules. For any VPS exposed to the internet \u2014 whether running SSH, a web server, or mail services \u2014 fail2ban is a critical first line of defense. This guide covers installation, configuration of common jails, custom rule creation, and monitoring best practices.<\/p>\n\n\n\n
On Ubuntu or Debian-based systems, installation is a single command:<\/p>\n\n\n\n
apt update && apt install fail2ban -y<\/code><\/pre>\n\n\n\nAfter installation, copy the default configuration file \u2014 never edit jail.conf directly, as package updates will overwrite it:<\/p>\n\n\n\n
cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\nConfiguring the SSH Jail<\/h3>\n\n\n\n
SSH brute-force attacks are the most common threat to any VPS. Edit \/etc\/fail2ban\/jail.local and ensure the SSH jail is enabled:<\/p>\n\n\n\n
[sshd]\nenabled = true\nport = ssh\nfilter = sshd\nlogpath = \/var\/log\/auth.log\nmaxretry = 5\nbantime = 3600\nfindtime = 600<\/code><\/pre>\n\n\n\nThis configuration bans an IP for 1 hour after 5 failed login attempts within 10 minutes. For higher-security setups, reduce maxretry to 3 and increase bantime to 86400 (24 hours).<\/p>\n\n\n\n
Web Server Protection (Nginx\/Apache)<\/h3>\n\n\n\n
Fail2ban ships with jails for common web attacks. Enable the Nginx jail to block bots probing for vulnerable paths:<\/p>\n\n\n\n
[nginx-http-auth]\nenabled = true\nport = http,https\nfilter = nginx-http-auth\nlogpath = \/var\/log\/nginx\/error.log\nmaxretry = 3\nbantime = 3600\n\n[nginx-botsearch]\nenabled = true\nport = http,https\nfilter = nginx-botsearch\nlogpath = \/var\/log\/nginx\/access.log\nmaxretry = 10\nbantime = 3600<\/code><\/pre>\n\n\n\nCreating Custom Filters<\/h3>\n\n\n\n
If you run a custom application, you can create your own fail2ban filter. For example, to block IPs that hit a non-existent WordPress XML-RPC endpoint repeatedly:<\/p>\n\n\n\n
# \/etc\/fail2ban\/filter.d\/wp-xmlrpc.conf\n[Definition]\nfailregex = ^<HOST>.*POST .*\/xmlrpc\\.php.* 404\nignoreregex =<\/code><\/pre>\n\n\n\nThen add a corresponding jail in jail.local and restart fail2ban.<\/p>\n\n\n\n
Monitoring and Maintenance<\/h3>\n\n\n\n
Check the current ban status with:<\/p>\n\n\n\n
fail2ban-client status\nfail2ban-client status sshd<\/code><\/pre>\n\n\n\nView banned IPs in the firewall:<\/p>\n\n\n\n
iptables -L -n | grep f2b<\/code><\/pre>\n\n\n\nSet up email alerts for bans by adding destemail = you@example.com and action = %(action_mw)s to your jails. Restart fail2ban after any config change: systemctl restart fail2ban.<\/p>\n\n\n\n
Conclusion<\/h3>\n\n\n\n