Notes - Fail2ban | Roger Fan

Fail2ban

Created: 2025-11-30

Updated: 2025-11-30

Comprehensive Fail2ban configuration for intrusion prevention including filters, jails, and actions to protect SSH, web, and mail services

Architecture

Text

  ┌─────────────┐
  │  Log Files  │ (auth.log, nginx/error.log, mail.log, etc.)
  └──────┬──────┘
         │
         ├──► Fail2ban reads logs
         │
  ┌──────▼──────────┐
  │    FILTERS      │ (regex patterns to detect attacks)
  │  /etc/fail2ban/ │
  │    filter.d/    │
  └──────┬──────────┘
         │
         ├──► Matches patterns (failed login, bot, etc.)
         │
  ┌──────▼──────────┐

Login Required

Fail2ban

Architecture

Architecture