FlashPanel

Fail2Ban ​

What is Fail2Ban? ​

Fail2Ban is an intrusion prevention software framework that protects your server from brute-force attacks by monitoring logs and automatically banning suspicious IPs.

It works by scanning log files (e.g., SSH, FTP, Nginx, etc.), detecting failed login attempts or other suspicious activities, and then updating firewall rules to ban the offending IP addresses temporarily or permanently.

Installing Fail2Ban ​

Requirement

The Fail2Ban management page is available for servers on a paid plan only.

To install Fail2Ban on your server via FlashPanel:

  1. Click the server's Apps menu.
  2. Select the Not Installed tab and search for Fail2Ban.
  3. Click Install and wait for the process to complete.

Once installed, the service starts automatically. To open the management page, click the server's Security > Fail2Ban menu.

Managing Fail2Ban ​

FlashPanel provides a dedicated interface to manage Fail2Ban:

General Controls ​

At the top of the Jails table, you can:

  • See the Fail2Ban service status
  • Start / Restart / Stop the service
  • Config: View and edit the Fail2Ban configuration file
  • Log: View the Fail2Ban activity log
  • Click Reload to refresh the jail list

Jail Management ​

The Jails table shows the following columns:

  • File and Jail: Configuration file name and jail name
  • Status: Whether the jail is enabled or disabled
  • Failed (currently/total): Current / total failed login attempts
  • Banned (currently/total): Currently banned IPs / total bans
  • Banned IPs: Number of currently banned IPs. Click the eye icon to see the list; click the x on an IP to unban it, or click Unban All IPs

Add or Edit a Jail ​

  1. Click Add (or the edit button on the jail's row)
  2. Fill in the details:
    • Jail Name: Name of the jail
    • Enable / Disable switch: Turn the jail on or off
    • Applied Filter: Filter used to detect suspicious behavior
    • Ban Action and Action: The ban action to perform
    • Port or Service and Protocol: Port/service and protocol to protect
    • Log File to Monitor: Log file to watch
    • Max Retry Before Ban: Maximum failures before banning
    • Find Time: Time window used to count failures
    • Ban Time: How long to ban (choose Lifetime to ban permanently)
    • Ignored IPs: IPs that are never banned (add your own IP)
  3. Click Submit to save

Use the delete button in the last column to remove a custom jail. You can protect services like SSH, FTP, Postfix, Nginx, and more.