Set Up Fail2Ban for Nginx on a VPS — Auto-Block IPs

Any VPS exposed to the internet is constantly scanned and probed by bots, especially sites running on Nginx. Fail2Ban blocks these IPs automatically. This guide configures Fail2Ban for Nginx on Ubuntu step by step.

What is Fail2Ban

Fail2Ban is a security tool that watches the logs of services like SSH, Nginx and mail. When it sees an IP repeatedly misbehaving — many failed logins, or an abnormally high request rate — it tells the firewall (iptables/nftables) to temporarily ban that IP. This stops brute-force attacks on its own, without you watching the screen.

Step 1 — Install Fail2Ban

Step 2 — Create jail.local

Don't edit jail.conf directly. Create jail.local instead so your settings aren't overwritten on update:

Step 3 — Enable jails for Nginx

Add Nginx jails in the same file to cover HTTP auth guessing and bots scanning for files:

Step 4 — Restart and check

This shows how many IPs are banned and which logs are being watched.

Unbanning an IP

To release an IP that was banned by mistake, run:

Adding a Rate-Limit Jail (nginx-req-limit)

Beyond the built-in jails you can defend against request floods that trigger Nginx's own limit_req directive. Create a custom filter at /etc/fail2ban/filter.d/nginx-req-limit.conf:

Then add the jail to jail.local:

This jail blocks any IP that exceeds the Nginx rate limit more than 10 times within the findtime window — providing an additional layer of protection against application-layer flood attacks.

Monitoring Fail2Ban in Real Time

Regular monitoring lets you confirm that Fail2Ban is working correctly and see which IPs are currently banned.

List all active jails

Inspect a specific jail

Stream the log live

The log shows every Ban and Unban event with the matching jail and IP address, making it easy to analyse which attack patterns are most common.

Incremental Ban Times

Fail2Ban supports incremental ban times that grow longer each time the same IP is banned again, discouraging repeat attackers.

Email Alerts on New Bans

Fail2Ban can send an email alert whenever a new IP is banned, using the built-in sendmail-whois action. Add these settings to the DEFAULT section of jail.local:

The action_mwl (mail with log) action sends an email with the relevant log lines attached, so you can immediately trace the source of an attack. If sendmail is not installed, use mailutils as a replacement:

VPS Security Checklist

Fail2Ban is one important layer of VPS security, but a well-hardened server needs multiple defences working together. Work through this checklist after setting up Fail2Ban.

• UFW Firewall: Allow only ports 22, 80 and 443 by default. Deny everything else.
• Disable SSH password auth: Set PasswordAuthentication no in /etc/ssh/sshd_config and use SSH key pairs only.
• Change the default SSH port (optional): Moving SSH from port 22 to a non-standard port significantly reduces automated bot scan noise.
• Keep packages updated: Run sudo apt update && sudo apt upgrade -y weekly or configure unattended-upgrades for security patches.
• Nginx rate limiting: Use limit_req_zone in Nginx config to throttle requests at the web server level before Fail2Ban acts.
• Regular log review: Check /var/log/fail2ban.log and /var/log/nginx/error.log at least once a week to spot unusual patterns early.

Security is an ongoing process. Revisit your configuration at least quarterly and follow CVE announcements for software running on your VPS to stay ahead of newly discovered vulnerabilities.

Frequently asked questions