What does Fail2ban do on a VPS?
It watches authentication logs and temporarily bans IPs that exceed the failure limit (jails). The most common case is protecting SSH against automated password attempts.
Fail2ban: how to protect a VPS against brute force attacks
Learn how to install and configure Fail2ban on an Ubuntu/Debian VPS to block SSH brute force: jail.local, UFW, systemd backend and how to check bans.
What does Fail2ban do on a VPS?
It watches authentication logs and temporarily bans IPs that exceed the failure limit (jails). The most common case is protecting SSH against automated password attempts.
Does Fail2ban replace Anti-DDoS?
No. Fail2ban acts at the operating system level against abuse of services such as SSH. Anti-DDoS on the provider network filters volumetric attacks before they reach your VPS.
Can I lock myself out when configuring Fail2ban?
Yes, if you miss the password several times or skip adding your static IP to ignoreip. Before tightening maxretry, add home, office or VPN IPs to ignoreip.
Why use jail.local instead of jail.conf?
fail2ban package updates overwrite jail.conf. jail.local or files in jail.d/ keep your rules without conflicting with the package.
Does Ubuntu 24.04 need the systemd backend?
In most cases, yes. Systems that use journald instead of /var/log/auth.log need backend = systemd for the sshd jail to work.
How do I unban a blocked IP?
Use sudo fail2ban-client set sshd unbanip CLIENT.IP. Confirm first with sudo fail2ban-client status sshd.
Frequently asked questions: Fail2ban: how to protect a VPS against brute force attacks
Does Fail2ban replace Anti-DDoS?
No. Fail2ban acts at the operating system level against abuse of services such as SSH. Anti-DDoS on the provider network filters volumetric attacks before they reach your VPS.
Can I lock myself out when configuring Fail2ban?
Yes, if you miss the password several times or skip adding your static IP to ignoreip. Before tightening maxretry, add home, office or VPN IPs to ignoreip.
Why use jail.local instead of jail.conf?
fail2ban package updates overwrite jail.conf. jail.local or files in jail.d/ keep your rules without conflicting with the package.
Does Ubuntu 24.04 need the systemd backend?
In most cases, yes. Systems that use journald instead of /var/log/auth.log need backend = systemd for the sshd jail to work.
How do I unban a blocked IP?
Use sudo fail2ban-client set sshd unbanip CLIENT.IP. Confirm first with sudo fail2ban-client status sshd.