fail2ban
Open-source daemon that scans logs and bans IPs showing malicious behavior via firewall rules.
HN commenters use it to temporarily ban IPs that brute-force SSH or probe web servers for forbidden URLs,1234 usually alongside rate limiting, geoblocking or WAF rules.567 Caveats include months of tuning, trouble behind load balancers and a false sense of security,89 and some prefer alternatives such as sshguard or PAM/nftables rate limiting.1011
Why people recommend it
Web log banning · 3
Parses HTTP logs to ban IPs that hit forbidden paths or trigger error codes.
“I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours”
“I just use fail2ban and it seems to do a pretty good job”
Show 1 more
“an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban”
Layered defense · 3
Commenters pair it with geoblocking, rate limiting, OWASP CRS rules or self-hosted apps.
“I use both on one port 22 host.”
“an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban”
Show 1 more
“I use a self hosted HedgeDoc with Fail2Ban to deal with this.”
Tunable bans · 3
Custom regex filters and ban durations let users set aggressive or temporary bans.
“an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban”
“I just use fail2ban and it seems to do a pretty good job”
Show 1 more
“I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours”
SSH brute-force · 2
Helps block repeated SSH login attempts on exposed hosts.
“Fail2ban also helps block repeated attempts like that.”
“I use both on one port 22 host.”
Effective once tuned · 1
One user says about 80 specific regexes have stopped all of the unwanted traffic.
“I just use fail2ban and it seems to do a pretty good job”
Caveats and dissent
Tuning effort · 1
You need to watch and tune it for the first couple of months.
“I just use fail2ban and it seems to do a pretty good job”
Load balancers · 1
It becomes a pain when traffic is handled through a load balancer.
“I just use fail2ban and it seems to do a pretty good job”
False security · 1
One evaluator of companies treats relying on fail2ban for protection as a sign of an insecure environment.
“right behind "we use fail2ban to protect us" as the #1 clue”
Alternatives preferred · 2
Some prefer PAM/nftables rate limiting or sshguard over log parsing.
“an (imo) better approach than fail2ban parsing your logs to deal with the problem”
“it's a drop-in replacement for fail2ban”
Python runtime · 1
It needs a Python runtime, which a drop-in replacement avoids.
“it's a drop-in replacement for fail2ban”
Often compared with
Threads where it came up
- How to Block Some of the Bots 2 mentions
- Ask HN: Alternatives to Fail2ban? 1 mention
- I close SSH port 22 (and what I use instead) 1 mention
- Ask HN: Protecting your Sites/Services from Unwanted Traffic? 1 mention
- AWS: Inaccurate Estimated Billing Data - $1.7 BILLION 1 mention
- JumpServer: Open-Source Privileged Access Management 1 mention
Also written as Fail2ban, Fail2Ban. Data: fail2ban.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 10
“it's a drop-in replacement for fail2ban”
“I use both on one port 22 host.”
“I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours”
“I just use fail2ban and it seems to do a pretty good job”
“an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban”
“I put fail2ban and I filtered a lot of ports”
“right behind "we use fail2ban to protect us" as the #1 clue”
“an (imo) better approach than fail2ban parsing your logs to deal with the problem”
“Fail2ban also helps block repeated attempts like that.”
“I use a self hosted HedgeDoc with Fail2Ban to deal with this.”