August 09, 2026 · by CLIQHOST
Every server connected to the internet is constantly scanned by bots looking for weak passwords, vulnerable services, and open ports. If you run a NVMe VPS or a dedicated server, one of the first protective measures you should take is installing Fail2Ban — an open-source tool that automatically bans IP addresses generating too many authentication failures.
In this guide you'll learn how to install, configure, and fine-tune Fail2Ban on a VPS running Ubuntu or CentOS, step by step.
Fail2Ban watches the log files of your services (SSH, Nginx, Apache, Postfix, etc.) and detects suspicious patterns — typically, multiple consecutive failed authentication attempts. When the configured threshold is exceeded, Fail2Ban automatically adds a rule to the firewall (iptables or nftables) that blocks the offending IP for a defined period.
Key concepts:
- Jail – a monitoring rule for a specific service
- Filter – the regex pattern that identifies suspicious log events
- Action – what happens when the filter triggers (ban, email alert, etc.)
- bantime – how long an IP stays banned (default: 10 minutes)
- maxretry – maximum allowed failed attempts before a ban
- findtime – the time window in which attempts are counted
You'll need:
- A VPS running Ubuntu 20.04/22.04 or CentOS 7/8 (root or sudo access)
- Active SSH access
- iptables or nftables installed (present by default on most distributions)
If you haven't secured SSH access yet, check out our VPS hardening guide before continuing.
EN
RO — Română
RU — Русский
sudo apt update && sudo apt install fail2ban -y
sudo yum install epel-release -y
sudo yum install fail2ban -y
After installation, enable and start the service:
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
Verify its status:
sudo systemctl status fail2ban
You should see active (running) in the output.
Fail2Ban ships with a main file at /etc/fail2ban/jail.conf. Never edit this file directly — it will be overwritten on upgrades. Instead, create a local override:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Now edit jail.local:
sudo nano /etc/fail2ban/jail.local
[DEFAULT]
bantime = 3600 # 1 hour
findtime = 600 # 10 minutes
maxretry = 5 # 5 attempts
ignoreip = 127.0.0.1/8 ::1 # always-allowed IPs
Tip: Add your own static IP to
ignoreipso you never accidentally lock yourself out.
SSH protection is the top priority. Enable the sshd jail in jail.local:
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
bantime = 86400 # 24 hours
If you changed your SSH port (e.g., to 2222), specify it explicitly:
port = 2222
Restart Fail2Ban to apply changes:
sudo systemctl restart fail2ban
Check the jail status:
sudo fail2ban-client status sshd
The output will show the current number of banned IPs and the total ban count.
If you're running a web server on your SSD VPS, also protect ports 80/443 from aggressive scanning and login page attacks.
[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 5
[nginx-botsearch]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 10
findtime = 300
bantime = 3600
[apache-auth]
enabled = true
port = http,https
logpath = /var/log/apache2/error.log
maxretry = 5
[apache-badbots]
enabled = true
port = http,https
logpath = /var/log/apache2/access.log
maxretry = 2
After any changes, reload:
sudo systemctl reload fail2ban
You can configure Fail2Ban to send an email every time an IP is banned. You'll need sendmail or postfix installed.
In the [DEFAULT] section of jail.local:
destemail = [email protected]
sender = [email protected]
mta = sendmail
action = %(action_mwl)s
action_mwl sends an email with the relevant log lines — useful for auditing and debugging.
Once Fail2Ban is running, these are the commands you'll use most often:
# Overall status
sudo fail2ban-client status
# Status of a specific jail
sudo fail2ban-client status sshd
# Manually unban an IP
sudo fail2ban-client set sshd unbanip 1.2.3.4
# Manually ban an IP
sudo fail2ban-client set sshd banip 1.2.3.4
# Watch Fail2Ban log in real time
sudo tail -f /var/log/fail2ban.log
If you run a custom application (e.g., a REST API) and want to protect a specific endpoint, you can write your own filter.
Create /etc/fail2ban/filter.d/myapp.conf:
[Definition]
failregex = ^<HOST> .* "POST /api/login HTTP/.*" 401
ignoreregex =
Then add the jail to jail.local:
[myapp-login]
enabled = true
port = http,https
filter = myapp
logpath = /var/log/nginx/access.log
maxretry = 5
bantime = 7200
Test the filter before activating it:
sudo fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/myapp.conf
bantime.increment = true to double the ban duration for repeat offenders from the same IP.Fail2Ban is an essential tool in any Linux server administrator's toolkit. Installation takes just a few minutes, and proper configuration can block thousands of automated attacks every day, significantly reducing your server's attack surface.
If you're starting fresh and need a fast, reliable platform, explore NVMe VPS plans from CLIQHOST — built for performance with full root access for advanced configurations. Need help with the setup? Contact our team and we'll get your server secured from day one.
Real reviews from customers who trust CLIQHOST for performance, reliability and expert technical support.
"We moved our online shop from a foreign host and the difference is night and day — pages load instantly and support replies in minutes, in Romanian."
"Migrated 12 client sites to CLIQHOST. Free migration, zero downtime, and the cPanel setup is exactly what my team needed. Highly recommend."
"Our NVMe VPS handles traffic spikes without a sweat. Full root, local datacenter, and billing in MDL — everything we wanted from a provider."
