fail2ban Configuration: Protecting a VPS from Brute Force in 2025

fail2ban is the first line of defence against automated attacks. Configured properly, it stops 99% of brute-force traffic.

Installation

apt install fail2ban
systemctl enable --now fail2ban

Base configuration in /etc/fail2ban/jail.local

[DEFAULT]
bantime  = 3600      ; 1 hour
findtime = 600       ; within 10 minutes
maxretry = 5
ignoreip = 127.0.0.1 1.2.3.4  ; your own IP

[sshd]
enabled = true
port    = 2222  ; if you changed the SSH port
logpath = /var/log/auth.log

[nginx-http-auth]
enabled  = true
logpath  = /var/log/nginx/error.log

[nginx-botsearch]
enabled  = true
logpath  = /var/log/nginx/access.log
maxretry = 2

WordPress protection (VPS without a control panel)

[wordpress]
enabled  = true
filter   = wordpress
logpath  = /var/log/nginx/access.log
maxretry = 3
bantime  = 86400

The filter in /etc/fail2ban/filter.d/wordpress.conf:

[Definition]
failregex = ^<HOST>.*"POST /wp-login.php

The recidive jail — long bans for repeat offenders

[recidive]
enabled  = true
logpath  = /var/log/fail2ban.log
bantime  = 604800  ; 1 week
findtime = 86400
maxretry = 3

Checking it works

fail2ban-client status
fail2ban-client status sshd

Need this set up? Order fail2ban configuration for your VPS.