How to Set Up Fail2Ban — Brute-Force Defence 2026

Enterno.io Editorial Team

How to Configure Fail2Ban for Server Defence

By Anatoly Oshmanovsky · Updated Apr 17, 2026

Key idea:

Fail2Ban is an open-source IDS blocking IPs after N failed attempts. Linux-server security standard. Protects: SSH brute-force, web-app login bruteforce, CMS scanning. Setup in 30 min: apt install fail2ban → jail.local → restart. Supports iptables + nftables + firewalld.

Below: step-by-step, working examples, common pitfalls, FAQ.

Try it now — free →

Step-by-Step Setup

Install: apt install fail2ban (Debian/Ubuntu) or yum install fail2ban (RHEL)
Copy: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
In jail.local: [DEFAULT] bantime = 3600; findtime = 600; maxretry = 3
Enable SSH jail: [sshd] enabled = true
For web app: create a custom filter in /etc/fail2ban/filter.d/myapp.conf
Restart: systemctl restart fail2ban
Monitor: fail2ban-client status sshd shows banned IPs + stats

Working Examples

Scenario	Config
/etc/fail2ban/jail.local (SSH)	`[sshd] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 bantime = 3600`
Custom filter for nginx login	`# /etc/fail2ban/filter.d/nginx-login.conf [Definition] failregex = .POST /login HTTP. 401 ignoreregex =`
Enable nginx-login jail	`[nginx-login] enabled = true port = http,https filter = nginx-login logpath = /var/log/nginx/access.log maxretry = 5 findtime = 300 bantime = 1800`
Unban IP manually	`fail2ban-client set sshd unbanip 1.2.3.4`
Telegram alerts on ban	`action = %(action_mwl)s + telegram-action # custom action`

Common Pitfalls

Forgot ignoreip with your admin IP — you get banned
bantime = 1h vs aggressive bots = they return every hour with a fresh IP
maxretry = 10 — too liberal for SSH (attacker gets 10 password tries)
No persistent banning — restart wipes bans (default behaviour)
nginx log format differs from default fail2ban filter — nothing banned

HeadersCSP, HSTS, X-Frame-Options, etc.

SSL/TLSEncryption and certificate

ConfigurationServer settings and leaks

Grade A-FOverall security score

Why teams trust us

OWASP

guidelines

15+

security headers

<2s

result

A–F

security grade

How it works

Enter site URL

Security headers analyzed

Get grade A–F

What Does the Security Analysis Check?

The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.

Header Analysis

Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.

SSL Check

TLS version, certificate expiry, chain of trust, HSTS support.

Leak Detection

Finding exposed server versions, debug modes, open configs, and directories.

Report with Recommendations

Detailed report explaining each issue with specific steps to fix it.

Who uses this

Security teams

HTTP header audit

DevOps

config verification

Developers

CSP & HSTS setup

Auditors

compliance checks

Common Mistakes

❌

Missing Content-Security-PolicyCSP is the primary XSS defense. Without it, script injection is much easier.

❌

Missing HSTS headerWithout HSTS, HTTPS-to-HTTP downgrade attacks are possible. Enable Strict-Transport-Security.

❌

Server header exposes versionServer: Apache/2.4.52 helps attackers find exploits. Hide the version.

❌

X-Frame-Options not setSite can be embedded in iframe for clickjacking. Set DENY or SAMEORIGIN.

❌

Missing X-Content-Type-OptionsWithout nosniff, browsers may misinterpret file types (MIME sniffing).

Best Practices

✓

Start with basic headersMinimum: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Takes 5 minutes.

✓

Implement CSP graduallyStart with Content-Security-Policy-Report-Only, monitor violations, then enforce.

✓

Hide server headersRemove Server, X-Powered-By, X-AspNet-Version from responses.

✓

Configure Permissions-PolicyRestrict camera, microphone, geolocation access — only what is actually used.

✓

Check after every deploySecurity headers can be overwritten during server configuration updates.

Get more with a free account

Security check history and HTTP security header monitoring.

Learn more

How-to

Glossary

Research

Alternatives

Frequently Asked Questions

Does Fail2Ban block IPv6?

Yes, if your iptables/nftables v6 support is enabled. <code>fail2ban-client status</code> shows mixed v4/v6 bans.

Will it block legitimate users?

Theoretically yes if maxretry is low. Mitigation: sensible maxretry (3-5), bantime not too long (1-24 h), ignoreip for known IPs.

Fail2Ban replacement?

CrowdSec — modern alternative with community threat feed. Fail2Ban still simpler for single-server setups.

How to monitor banned IPs?

<code>fail2ban-client status [jail]</code> or parse <code>/var/log/fail2ban.log</code>. For Enterno <a href="/en/security">Security Scanner</a> shows security posture.