# Fail2Ban

> Log-monitoring daemon that dynamically blocks IP addresses causing repeated authentication failures.

Fail2Ban monitors system and service logs for malicious activity, such as repetitive SSH brute-force attempts. When an IP address exceeds the configured threshold of failed attempts, it dynamically updates system firewall rules (like iptables) to reject connections from that address for a set duration. It includes built-in filters for standard services like SSH and Apache and can be extended to monitor custom application logs.

Website: https://github.com/fail2ban/fail2ban

## What it is for

- Block automated brute-force password guessing on SSH ports
- Throttle repeated failed authentication attempts against Apache or Nginx servers
- Ban abusive IP addresses from custom application endpoints based on log patterns

## Features

- Automated log monitoring across standard system logs (auth.log, syslogs)
- Dynamic firewall management via iptables, nftables, or system firewalls
- Configurable ban duration, find time, and retry limits per jail
- Preconfigured filters for SSH, web servers, mail services, and more
- Custom regex pattern matching for custom log files
- Support for IPv4 and IPv6 address parsing and blocking

## Pricing

Open source

## Details

- Type: GitHub repo
- Category: [Development](https://xiry.app/topics/development.md)
- Topic: [Server Security](https://xiry.app/topics/development/server-security.md)
- Open source: yes
- Platforms: Linux, Command line, Self-hosted
- For: Linux systems administrators, DevOps engineers, and self-hosters securing network servers.
- Alternative to: CrowdSec, DenyHosts
- Tags: security, firewall, sysadmin, brute force, intrusion prevention, linux

## Why it was saved

- [@brusnicadev, 16 August 2026](https://www.instagram.com/reel/DcGacI2D1gF/): Automatically updates firewall rules (e.g. iptables) to drop traffic from IPs that exceed failed authentication thresholds.

## Related

- [Check SSH Brute-Force Login Attempts](https://xiry.app/resources/check-ssh-brute-force-login-attempts): Terminal commands to count and monitor failed SSH logins on Linux (Tip, Free)
- [CrowdSec](https://xiry.app/resources/crowdsec): Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data. (GitHub repo, Open source)
- [endlessh-go](https://xiry.app/resources/endlessh-go): SSH tarpit written in Go with built-in Prometheus metrics and Grafana support (GitHub repo, Open source)
- [SSH Brute-Force Protection with fail2ban and ufw](https://xiry.app/resources/ssh-brute-force-protection-with-fail2ban-and-ufw): Quick commands to detect and block SSH brute-force attacks on Linux (Tip, Free)
- [AIMap](https://xiry.app/resources/aimap): Discovery and security testing platform for exposed internet-facing AI endpoints. (Web app, Open source)
- [Better Auth](https://xiry.app/resources/better-auth): Open-source TypeScript authentication framework for modern web applications. (GitHub repo, Open source)

Updated 3 October 2026. Page: https://xiry.app/resources/fail2ban

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.