Tools · SPBoucher
Menu

Fail2Ban

by Fail2Ban project · Application · also known as fail2ban

Log-scanning intrusion-prevention daemon that temporarily bans IP addresses showing repeated authentication failures by updating firewall rules

GPL-2.0-or-later licenseOpen sourceFreeSelf-hostedSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

Fail2Ban is an open-source intrusion-prevention tool, written in Python and licensed under GPL-2.0 or later, that watches log files such as the SSH authentication log or web server access logs, matches failure patterns with regular expressions, and after a configurable number of hits within a time window bans the offending address for a period by inserting firewall rules. Jails pair a filter (what to match) with an action (what to do), and the package ships with filters for sshd, many mail servers, NGINX, Apache and other services, plus actions for iptables, nftables, firewalld, pf and even email notification. IPv6 is supported.

It is a standard addition to any server with sshd exposed to the internet, cutting the volume of brute-force attempts and the noise in logs. The fail2ban.org domain now points to the GitHub repository, which hosts the documentation wiki.

Fail2Ban reacts only to what appears in local logs, so it has no notion of reputation shared across machines, can lock out legitimate users behind NAT, and must be tuned when log formats change.

Capabilities

  • Regex-based log filters for sshd, web servers, mail servers and custom services
  • Time-windowed thresholds with configurable ban durations and recidive escalation
  • Actions for iptables, nftables, firewalld, pf and notification hooks
  • IPv4 and IPv6 support
  • fail2ban-client for inspecting and managing jails at runtime

Typical workflows

  1. Protect an internet-facing SSH server from password guessing
  2. Ban clients hammering a login endpoint behind NGINX
  3. Escalate repeat offenders with the recidive jail

Strengths

  • Simple to install and enable with sane defaults
  • Works with any service that writes logs
  • Lightweight and packaged by every major distribution

Limitations

  • Local signals only; no shared threat intelligence
  • Can block legitimate users sharing an IP address
  • Filters need maintenance when log formats change

Prerequisites

  • Python 3
  • Root access to manage the firewall

Who it is for

  • Linux and BSD server administrators
  • Self-hosters exposing SSH or web logins

Alternatives & comparison

CrowdSec covers the same detect-and-ban loop but adds behavior scenarios, remediation components for proxies and CDNs, and a crowd-sourced reputation blocklist; Fail2Ban remains the simpler, dependency-free choice for a single host.

  • CrowdSec

    Open-source behavior-based intrusion prevention engine whose detections feed a crowd-sourced IP reputation network, with remediation components for firewalls, proxies and CDNs

    MixedOpen source

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    Fail2Ban COPYING (GPL-2.0)

    https://github.com/fail2ban/fail2ban/blob/master/COPYING

    Supports: license_spdx, source_model

    checked Nov 1, 2026
  • Official documentation
    Fail2Ban Wiki

    https://github.com/fail2ban/fail2ban/wiki

    Supports: capabilities, workflows

    checked Nov 1, 2026
  • Official site
    fail2ban/fail2ban on GitHub

    https://github.com/fail2ban/fail2ban

    Supports: name, summary, capabilities

    www.fail2ban.org redirects to this repository.

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

Cloudflare

Cloudflare, Inc. · DNS & domains

Global network offering authoritative DNS, CDN and reverse-proxy security, a domain registrar, Zero Trust access and the Workers serverless platform

ProprietaryFreemiumPaidNov 2, 2026

Semgrep

Semgrep, Inc. · Security tools

Static analysis engine that matches code patterns written in the target language's own syntax, with an LGPL community edition and a commercial AppSec platform

LGPL-2.1-onlyOpen sourceFreemiumLocalNov 2, 2026

promptfoo

Promptfoo, Inc. · Prompting, evaluation & observability

Open-source, local-first CLI and library for evaluating prompts, models, RAG pipelines and agents, with automated red teaming and CI integration

MITOpen sourceFreeLocalSelf-hostedBroken

Trivy

Aqua Security · Security tools

Open-source scanner that finds known vulnerabilities, misconfigurations, exposed secrets and license issues in container images, file systems, git repositories, IaC and Kubernetes clusters

Apache-2.0Open sourceFreeLocalSelf-hostedNov 2, 2026