Fail2Ban is a security daemon that monitors your server's log files and automatically bans IPs exhibiting malicious behavior—such as repeated failed login attempts. Installing it on your VPS is one of the most effective, lowest-maintenance security measures you can take.
Why You Need Fail2Ban on Your VPS
Any Linux server with SSH exposed to the internet receives hundreds—sometimes thousands—of login attempts every day. Bots scan entire IP ranges looking for weak passwords or default accounts.
Without active protection, these probes waste server resources and, in the worst case, lead to a full compromise. Fail2Ban acts as an automated guard: it reads your logs, spots suspicious patterns, and adds firewall rules to cut off attackers before they succeed.
Key threats it mitigates:
- SSH dictionary and brute force attacks — the most common use case.
- Web panel login attempts (cPanel, Plesk, WordPress admin).
- Repeated port scans from the same IP.
- API or form abuse with multiple failed requests.
Installing Fail2Ban on Linux
Installation varies slightly by distribution. On Debian/Ubuntu:
sudo apt update && sudo apt install fail2ban -yOn CentOS/AlmaLinux/Rocky Linux:
sudo dnf install epel-release -y
sudo dnf install fail2ban -yEnable and start the service:
sudo systemctl enable fail2ban
sudo systemctl start fail2banConfirm it is running:
sudo systemctl status fail2banBasic Configuration: the jail.local File
Fail2Ban splits configuration into two layers: jail.conf (defaults, never edit directly) and jail.local (your overrides). Always work with the second one.
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.localThe most important global parameters under [DEFAULT]:
| Parameter | What it does | Recommended value |
|---|---|---|
bantime |
How long an IP stays banned | 1h (or -1 for permanent) |
findtime |
Time window analyzed for failures | 10m |
maxretry |
Failed attempts before a ban | 5 |
ignoreip |
IPs that are never banned | Your office / home IP |
Important: always add your own IP to ignoreip to avoid accidentally locking yourself out.
ignoreip = 127.0.0.1/8 ::1 203.0.113.50Enabling and Tuning the SSH Jail
The [sshd] jail is the most critical one. Find (or add) this section in jail.local:
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
bantime = 24hIf you changed the default SSH port (22) to a custom one—a good practice—specify it:
port = 2222Reload Fail2Ban after any change:
sudo fail2ban-client reloadDay-to-Day Management Commands
Once active, these are the commands you will use most often:
Check overall status and active jails
sudo fail2ban-client status
sudo fail2ban-client status sshdUnban a specific IP
sudo fail2ban-client set sshd unbanip 198.51.100.42Manually ban an IP
sudo fail2ban-client set sshd banip 198.51.100.99Watch the Fail2Ban log in real time
sudo tail -f /var/log/fail2ban.logFor a complete server maintenance routine, check out the VPS maintenance checklist in our servers section.
Protecting Services Beyond SSH
Fail2Ban ships with pre-built filters for dozens of applications. Some useful jails:
- Apache / Nginx — blocks vulnerability scans and malformed requests (
[apache-auth],[nginx-http-auth]). - Postfix / Dovecot — protects your mail server against spam bots (
[postfix],[dovecot]). - WordPress xmlrpc — filters attacks on the XML-RPC endpoint with a custom filter.
For each service, add the corresponding section in jail.local with enabled = true and adjust maxretry and bantime according to the risk level.
If your VPS sits behind Cloudflare or a reverse proxy, make sure your logs record the real client IP (via the X-Forwarded-For header or Apache's mod_remoteip)—not the proxy IP—or Fail2Ban will ban the proxy instead of the attacker.
Want your VPS configured and secured from the ground up? The team at elenlace.com offers fully managed VPS plans with security built in from day one.
Key Takeaways
- Fail2Ban reads log files and automatically applies firewall rules to block suspicious IPs.
- Always edit
jail.local, neverjail.conf. - Add your own IP to
ignoreipbefore enabling any jail. - Start with the
[sshd]jail, then extend protection to Apache, Nginx, or your mail server. - If your server is behind a proxy, verify that logs capture the real client IP.
Fail2Ban is a lightweight but highly effective defense layer. Set it up today and let it run silently in the background. Need full server hardening without the manual work? elenlace.com can handle it for you with a managed VPS plan.
FAQ
Does Fail2Ban replace a firewall?
No. Fail2Ban complements your firewall by dynamically adding and removing rules. It does not replace UFW, iptables, or firewalld—you should run both simultaneously.
What if I accidentally lock myself out?
If you have access to your VPS provider's console (KVM/IPMI), log in from there and run sudo fail2ban-client set sshd unbanip YOUR_IP. To prevent this, always add your IP to ignoreip before enabling Fail2Ban.
How much does Fail2Ban consume in terms of resources?
Very little. The process uses only a few MB of RAM and has minimal CPU impact, even on a 1 GB VPS. It is one of the lightest security daemons available.
Does Fail2Ban work with IPv6?
Yes. Fail2Ban supports IPv6 natively. Make sure allowipv6 = auto (or yes) is set in the [DEFAULT] section of your jail.local so that bans also apply to IPv6 addresses.
Further reading
Other providers and guides worth comparing:
