How to Install Fail2ban on Ubuntu

What Fail2ban does

The moment a server is reachable from the internet, automated bots start hammering it with login attempts. Fail2ban watches your log files, spots repeated failures from the same IP, and temporarily bans that address at the firewall. It's a simple, effective layer that dramatically cuts brute-force noise.

Step 1: Install

On Debian or Ubuntu:

sudo apt update
sudo apt install fail2ban

Fail2ban starts automatically. Confirm it's running:

sudo systemctl status fail2ban

Step 2: Create a local config

Never edit jail.conf directly — it's overwritten on upgrades. Create a jail.local override instead:

sudo nano /etc/fail2ban/jail.local

[DEFAULT]
# Ban for 1 hour after 5 failures within 10 minutes
bantime  = 1h
findtime = 10m
maxretry = 5
 
# Never ban your own network
ignoreip = 127.0.0.1/8 192.168.1.0/24
 
# Use nftables (modern) or iptables
banaction = nftables-multiport
 
[sshd]
enabled = true
port    = ssh

Adjust ignoreip to your LAN so you can't accidentally lock yourself out.

Step 3: Apply and verify

sudo systemctl restart fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd

The sshd status shows currently failed and banned IPs. Within a day of internet exposure, you'll usually see bans accumulating.

Step 4: Escalating bans (recommended)

Repeat offenders should be banned for longer. Enable incremental banning in [DEFAULT]:

bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 1w

Now a persistent attacker's ban time doubles each time, up to a week.

Step 5: Protect more than SSH

Fail2ban ships with filters for many services. Useful jails for a homelab:

Nginx / Nginx Proxy Manager — ban IPs failing HTTP basic-auth or hitting bad URLs.
Vaultwarden — a community filter bans failed master-password attempts.
Home Assistant — ban repeated failed logins.

Each is a small [jail] block pointing at the right log path and filter.

Step 6: Managing bans

# Unban an IP you banned by mistake
sudo fail2ban-client set sshd unbanip 203.0.113.9
 
# See everything
sudo fail2ban-client status

Important context

Fail2ban is a complement, not a replacement, for good security. The biggest wins are still:

Disabling SSH password auth in favor of keys.
Keeping services off the public internet behind a VPN where possible.
Enabling two-factor authentication on exposed dashboards.

See the full home server security checklist for the complete picture.

Troubleshooting

Locked yourself out — access via console/KVM and add your IP to ignoreip.
No bans ever appear — confirm the log path matches your distro and the jail is enabled = true.
Bans don't actually block — verify banaction matches your firewall backend (nftables vs iptables).

Next steps

Layer Fail2ban with a properly configured firewall and reverse proxy, then monitor ban activity over time in Grafana if you enjoy the visibility.