← Back to Blog

How to Set Up Fail2ban on a VPS (2026)

Published May 4, 2026 · 5 min read · Galaxy Cloud Solutions

Every public-facing server gets SSH brute force attempts within hours of going online. Bots constantly scan the internet looking for weak passwords. Fail2ban watches your auth logs and automatically bans IPs that rack up too many failed login attempts. It is one of the first things you should install on a new VPS.

⚡ VPS from $5/mo — Use code LAUNCH2026 for 50% off

Step 1: Install Fail2ban

sudo apt update
sudo apt install -y fail2ban

Step 2: Create a Local Config

Never edit the main jail.conf file — it gets overwritten on updates. Create a local override instead:

sudo tee /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 5
backend  = systemd

[sshd]
enabled  = true
port     = ssh
logpath  = %(sshd_log)s
EOF

This configuration bans any IP that fails SSH login 5 times within 10 minutes, for 1 hour. Adjust bantime, findtime, and maxretry to be stricter or more lenient based on your needs.

Step 3: Enable and Start Fail2ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Step 4: Verify It Is Working

sudo fail2ban-client status
sudo fail2ban-client status sshd

The status command shows active jails. The sshd status shows currently banned IPs and total bans.

Useful Fail2ban Commands

# Check banned IPs in sshd jail
sudo fail2ban-client status sshd

# Unban a specific IP
sudo fail2ban-client set sshd unbanip 1.2.3.4

# Check fail2ban logs
sudo tail -f /var/log/fail2ban.log

# Reload config after changes
sudo fail2ban-client reload

Whitelisting Your Own IP

Add your home IP to the ignore list so you can never accidentally lock yourself out:

sudo nano /etc/fail2ban/jail.local

Add this under [DEFAULT]:

ignoreip = 127.0.0.1/8 ::1 YOUR.HOME.IP.HERE

sudo fail2ban-client reload

Protecting Nginx Too

If you run a web server, you can also protect it from HTTP brute force:

[nginx-http-auth]
enabled  = true
port     = http,https
logpath  = %(nginx_error_log)s