# Fail2ban with iptables **URL:** \ **Category:** Cybersecurity\ **Created:** [April 26, 2021, 8:28pm UTC](https://community.unix.com/t/fail2ban-with-iptables/382587 "2021-04-26T20:28:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![bucminhdo](https://community.unix.com/letter_avatar/bucminhdo/32/5_5575768a8748004e209b776fc1b2916d.png) [@bucminhdo](https://community.unix.com/u/bucminhdo)\ **Post date:** [April 26, 2021, 8:28pm UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/1 "2021-04-26T20:28:06Z")
Hi guys, I am using CentOS 8 and use iptables as a main firewall I've just installed fail2ban and configured "/etc/fail2ba/jail.local" as below ``` [sshd] enabled = true action = iptables[name=SSH, port=ssh, protocol=tcp] filter = sshd logpath = /var/log/secure maxretry = 3 bantime = 24h ignoreip = 80.234.40.124 ``` But after `systemctl restart fail2ban.service`, when I checked rules on iptables, I found my iptables' rules have not changed anything ``` [root@vps home]# iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- 80.234.40.124 anywhere ACCEPT icmp -- 80.234.40.124 anywhere icmp echo-request Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ``` So the question is: 1. How will iptables rules work against fail2ban rules? Who will have priority over? 2. How do I add fail2ban rules to iptables? 3. Looking at the information of the iptables table, we can see that all IPs that are not 80.234.40.124 will be DROP. In fact, this will prvent from brute force password attacking on VPS. The question is, does it make sense to use fail2ban in this case? **Best Regards!** ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [April 27, 2021, 5:45am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/2 "2021-04-27T05:45:48Z")
> [@bucminhdo](#): > > it make sense to use fail2ban in this case? It's not a problem to use `failtoban`. You can always flush the IPs blocked by `failtoban` with: ```shell iptables -F ``` Regarding "creating custom rules for `failtban`"; there are many tutorials on the net, for example: Perhaps one of the better `failtoban` tutorials on the net I have seen: > **[How to Use Fail2ban to Secure Your Server (A Tutorial)](https://www.linode.com/docs/guides/using-fail2ban-to-secure-your-server-a-tutorial/)** > > This guide shows you how to set up Fail2Ban, a log-parsing application, to monitor system logs, and detect automated attacks on your Linode. See also: > **[Updating Fail2ban and adding new rules - Domotic Project](https://domoticproject.com/updating-fail2ban-and-adding-new-rules/)** > > Contents The last stable version of fail2ban contained in Raspbian stretch  is 0.9.6-2. However, newer fail2ban versions include useful functionalities, such as the possibility to use a persistent datastore to save the IPs banned.... and [https://www.burlutsky.su/security/fail2ban-add-custom-rule/](https://www.burlutsky.su/security/fail2ban-add-custom-rule/) ---
**Author:** ![bendingrodriguez](https://community.unix.com/user_avatar/community.unix.com/bendingrodriguez/32/21971_2.png) [@bendingrodriguez](https://community.unix.com/u/bendingrodriguez)\ **Post date:** [April 27, 2021, 8:13am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/3 "2021-04-27T08:13:11Z")
> [@](#): > > - How will iptables rules work against fail2ban rules? Who will have priority over? f2b uses its own chains per filter, e.g. `f2b-sshd`. When f2b restarts, its chains are flushed and the currently saved ips (if any) from the DB (default sqlite) are re-added to the chains. Other self-written rules are not affected. But: If you call `iptables -F` by your own, you flush **all** chains and you have to restart the f2b service, if it already had data in its DB. And: f2b only creates its chains when it has found an ip to be blocked for the first time, see e.g. `/etc/fail2ban/action.d/iptables-multiport.conf`. f2b reads log files and looks for specific entries, like ```plaintext Apr 25 00:16:50 xxx sshd[29180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx ``` > [@](#): > > - How do I add fail2ban rules to iptables? f2b does that by itself, see above. f2b is a service that **uses** iptables to ban ips. > [@](#): > > - Looking at the information of the iptables table, we can see that all IPs that are not 80.234.40.124 will be DROP. In fact, this will prvent from brute force password attacking on VPS. The question is, does it make sense to use fail2ban in this case? f2b won't have much to do as it won't find any failed login attempts in e.g. `auth.log`, **except** for your socks server. You can test it by trying a wrong pwd N times (assuming that you deosn't use a ssh key). But be careful to not lock out youself, so you should have open a second terminal in parallel from where you can unban its ip. As mentioned before, a static management ip is always beneficial. f2b is particularly useful for services (not just ssh) that are accessible from **anywhere** , cause it mainly acts against bots. It also has the option of sending reports to [Blocklist](http://www.blocklist.de/en/index.html). ---
**Author:** ![czecz](https://community.unix.com/letter_avatar/czecz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czecz](https://community.unix.com/u/czecz)\ **Post date:** [April 28, 2021, 9:12am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/4 "2021-04-28T09:12:06Z")
consider using sshguard (vs fail2ban), if it would be easier for you to configure... ---
**Author:** ![bucminhdo](https://community.unix.com/letter_avatar/bucminhdo/32/5_5575768a8748004e209b776fc1b2916d.png) [@bucminhdo](https://community.unix.com/u/bucminhdo)\ **Post date:** [April 28, 2021, 9:26pm UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/5 "2021-04-28T21:26:19Z")
**Hi,** I still have one more concern **If I do not set rule for iptables** , I only set the rules for fail2ban. When I run command `iptables -L` , I can see the rule of fail2ban in iptables But if I set the rule for iptables first, then I set the rules for fail2ban. When I run command `iptables -L`, **I only see iptables rules, not seeing rules of fail2ban in iptables** ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [April 29, 2021, 3:19am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/6 "2021-04-29T03:19:55Z")
As I recall, `fail2ban` will add a rule to `iptables` AFTER it detects an anomaly, based on the way `fail2ban1` is configured. Frankly speaking, I'm not understanding where this line of questioning is leading. What is the "doubt" or "concern" on using a tool (`fail2ban`) which is used by "uncountable" sys admins, is very mature and very completely documented? I have used `fail2ban` on a number of servers for as long as I can remember, and it's never been a problem. It's just one of many tools available to sys admins to help secure their systems. ---
**Author:** ![bendingrodriguez](https://community.unix.com/user_avatar/community.unix.com/bendingrodriguez/32/21971_2.png) [@bendingrodriguez](https://community.unix.com/u/bendingrodriguez)\ **Post date:** [April 29, 2021, 5:23am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/7 "2021-04-29T05:23:40Z")
Hi @bucminhdo, I am not very clear what your question is. As stated, f2b creates a chain per jail and thus a first ipt rule only after it has discovered an ip to be blocked for the first time (default: 5 log entries). If it has not yet discovered an ip for a jail like `sshd`, there is still no chain `f2b-sshd`. And as said, you don't need to set ipt rules for f2b by youself, it is done by f2b. And with a `iptables -F` you not only delete your own rules, but also those of f2b (but not its chains, that needs `iptables -X`). But then f2b no longer knows which of its rules are active, so you should call `fail2ban-client reload sshd` afterwards. Also note the settings of `findtime` and `bantime`. Some useful commands are: ```shell # show config $ fail2ban-client --dp # show status of a jail $ fail2ban-client status sshd # unban an ip from all jails $ fail2ban-client unban ip 1.2.3.42 # show matched log entries $ fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf # show stored bans $ echo "select data from bans" | sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 | jq . # show commands & options $ fail2ban-client | less ``` And `iptables -vnL` prints also the number of packets & bytes matched per rule, showing ips & ports in numeric format. ---
**Author:** ![system](https://community.unix.com/uploads/default/original/2X/c/c7e9e16a595259edafe88615719d5c5dcda035c2.png) [@system](https://community.unix.com/u/system)\ **Post date:** [June 28, 2021, 5:23am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/8 "2021-06-28T05:23:44Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed. ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [March 26, 2025, 5:04am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/9 "2025-03-26T05:04:48Z")
> [@czecz](#): > > consider using sshguard (vs fail2ban), if it would be easier for you to configure... ### ChatGPT 4o (Skippy the Magnificent from EF Sci-Fi Series) Replies: Straight answer, Captain: ### ✅ **Fail2ban vs sshguard – key differences** | Feature | **Fail2ban** | **sshguard** | | --- | --- | --- | | **Complexity** | More complex, highly configurable | Lightweight, minimal configuration | | **Scope** | Works with any log file (Apache, sshd, etc.) | Primarily focused on SSH and syslog-based daemons | | **Backend** | Uses regex filters + iptables/nftables | Uses C binary for parsing logs, very fast | | **Dependencies** | Python, optional firewalld/iptables/nftables | Minimal, written in C | | **Flexibility** | High – create your own jails easily | Low – works mostly out-of-the-box for SSH | | **Ban mechanism** | Manual rules via regex + actions | Automatic parsing + firewall drop | | **Persistence** | Tracks bans over restarts (if configured) | Loses bans on restart unless persisted manually | | **Performance** | Slightly heavier with large rulesets | Faster startup, smaller memory footprint | | **Integration** | Works with firewalld, iptables, nftables | Mostly iptables or PF (BSD) | | **Logging** | Very verbose, detailed jail logs | Less verbose, simpler output | * * * ### ⚡ Bottom Line: - **Use `fail2ban`** when you want **fine-grained control** , multiple jails (Apache, sshd, etc.), custom regex, email alerts, integration with different firewalls. - **Use `sshguard`** if you want **lightweight, set-it-and-forget-it SSH protection** with minimal configuration and fast performance. * * * If you’re running a lean server and only care about SSH brute-force blocks, `sshguard` is efficient and solid. If you're defending a broader attack surface (Apache, FTP, custom apps), `fail2ban` is the better tactical choice. Your call, Captain. ---
**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\ **Post date:** [March 26, 2025, 5:05am UTC](https://community.unix.com/t/fail2ban-with-iptables/382587/10 "2025-03-26T05:05:04Z")
Opened because I am going to post some fail2ban jails and config files I have been using lately...... more to follow.