Where does fail2ban store its settings?

Defaults are in /etc/fail2ban/jail.conf. Your own settings go in /etc/fail2ban/jail.local.

How do I unban an IP address?

Run sudo fail2ban-client set sshd unbanip with the address.

Does it protect against all attacks?

No. It slows password guessing. Use SSH keys and keep software updated as well.

fail2ban jail.local example: ban repeated login failures

Ban addresses that keep failing to log in. Choose ban time, retries and which services to protect.

For Linux servers with fail2ban 0.10 or newer (Debian, Ubuntu, Fedora). Check the version with fail2ban-client --version.

fail2ban watches your logs and blocks addresses that fail to log in too many times. Put your settings in jail.local so package updates never overwrite them. Add your own address to the ignore list first, so you cannot lock yourself out.

Create your config file

Type your own values. The file below updates as you type, and nothing you type leaves your browser.

/etc/fail2ban/jail.local

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
port    = ssh
backend = auto

How this setup works

Diagram: Failed logins, then fail2ban, then Firewall — Failed logins (written to a log) → fail2ban (counts them) → Firewall (blocks the address)

Step-by-step setup

Install it: sudo apt install fail2ban (Debian, Ubuntu).
Save the config as /etc/fail2ban/jail.local.
Start it: sudo systemctl enable --now fail2ban, or sudo systemctl restart fail2ban after a change.
See the jails: sudo fail2ban-client status.
See banned addresses: sudo fail2ban-client status sshd.

What the important lines mean

An address that fails 5 times within 10m is banned for 1h.
ignoreip lists addresses that are never banned. Add yours.
jail.local overrides jail.conf, so package updates do not erase your settings.

Common errors and how to fix them

You locked yourself out: Wait for the ban to end, or from the console run sudo fail2ban-client set sshd unbanip YOUR.IP. Then add your address to ignoreip.
Have not found any log file for sshd jail: The log file does not exist. Choose the systemd journal as the SSH log source.
Failed to access socket path: Fail2ban is not running. Check systemctl status fail2ban and its log.
Bans do not block anything: Check that the firewall that fail2ban uses (iptables or nftables) is installed and active.

Frequently asked questions

Where does fail2ban store its settings?: Defaults are in /etc/fail2ban/jail.conf. Your own settings go in /etc/fail2ban/jail.local.
How do I unban an IP address?: Run sudo fail2ban-client set sshd unbanip with the address.
Does it protect against all attacks?: No. It slows password guessing. Use SSH keys and keep software updated as well.

Written for: fail2ban 1.0, Ubuntu 24.04 · Updated 2026-10-03

Free tools that help

Common ports listSearch a list of common TCP and UDP port numbers: SSH 22, HTTP 80, HTTPS 443, MySQL 3306, PostgreSQL 5432 and more, with dev server ports.

More server configs

PM2 ecosystem.config.jsRun a Node.js app with PM2: restarts on crash, memory limit, cluster mode and start at boot.
WireGuard server config (wg0.conf)Set up a WireGuard VPN server on Linux with one peer, NAT and the right commands.
WireGuard client configCreate the client file that connects to your WireGuard server, with DNS, allowed IPs and keepalive.
nginx HTTPS server blockServe your site over HTTPS with nginx: certificate paths, HTTP to HTTPS redirect, HSTS and a proxy or static site.
.htaccess fileBuild an Apache .htaccess file with an HTTPS redirect, www rules, compression, caching and a front controller.
robots.txt fileCreate a robots.txt that tells search engines what to crawl, with a sitemap line and optional AI crawler blocks.

See all 41 config generators