Guides / fail2ban

Stop SSH brute-force attacks with fail2ban

About 5 minutes. Debian or Ubuntu commands.

Bots scan every SSH port they can find and try common passwords. SSH keys are the best protection; fail2ban adds a second layer by blocking addresses after a few failed logins.

1. Install it

apt update && apt install -y fail2ban nftables

2. Turn on the SSH jail

Save as /etc/fail2ban/jail.d/sshd.local:

[sshd]
enabled  = true
backend  = systemd
banaction = nftables-multiport
maxretry = 5
findtime = 10m
bantime  = 1h

systemctl enable --now fail2ban
fail2ban-client status sshd

Important on a NAT VPS

Over IPv6 every attacker arrives with its own address, so bans work as usual. Over IPv4, SSH connections are forwarded to your server and arrive with the attacker's real address too, so they are banned individually. Never add 10.66.0.1 (our router) to a ban list: you would lock out HTTPS visitors over IPv4.

# unban an address if you lock yourself out
fail2ban-client set sshd unbanip 203.0.113.7