Fail2Ban is a Python-based program that scans log files (e.g., /var/log/auth.log) and blocks IP addresses that show signs of brute-force attacks or repeated failed login attempts. When it detects suspicious activity, Fail2Ban instructs the firewall (usually iptables) to block those IP addresses for a specified period. Fail2Ban is very lightweight and compatible with almost all popular Linux distributions, such as Debian, Ubuntu, CentOS, and Fedora. Beyond SSH, Fail2Ban can protect other services, such as FTP, Apache, Nginx, and Postfix. UFW (Uncomplicated Firewall) is a tool that can help manage a firewall on a server; it is a front-end interface that automatically manages iptables. UFW can help protect a server from other attacks by setting the appropriate rules. In this article, we will show you how to configure fail2ban and UFW on Ubuntu 26.04.
Prerequisites
- An Ubuntu 26.04 server
- SSH root access or a regular system user with sudo privileges
Conventions
# – given commands should be executed with root privileges either directly as a root user or by use of sudo command
$ – given commands should be executed as a regular userStep 1. Update the System
Log in to your Ubuntu 26.04 VPS via SSH as a root or as a regular user with sudo privileges.
ssh root@IP_Address -p Port_numberIf you cannot log in as root, replace “root” with a user with sudo privileges. Also, change “IP_Address” and “Port_Number” to match your server’s IP address and SSH port.
You can check whether you have the correct Ubuntu version installed on your server with the following command:
# lsb_release -aYou should get this output:
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 26.04
Release: 26.04
Codename: resoluteThat’s it; the system package information should now be updated.
Step 2. Install UFW
First, let’s check whether UFW is installed.
# apt list | grep ufwThe command will print a message similar to this:
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
gufw/resolute 26.04.0-0ubuntu1 all
libqt6protobufwellknowntypes6/resolute 6.10.2-1 amd64
ufw/resolute 0.36.2-9build1 allIf UFW is installed, it will look like this:
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
gufw/resolute 26.04.0-0ubuntu1 all
libqt6protobufwellknowntypes6/resolute 6.10.2-1 amd64
ufw/resolute,now 0.36.2-9build1 all [installed]Since it’s not installed on our Debian 13 system, we can install it now.
# apt install ufwThat’s it, UFW has been successfully installed.
Step 3. Set Default Policy
The main principles of a firewall are:
Allow = Allow the connection
Deny = Deny the connection
Reject = Deny and send a rejection notification
By default, UFW blocks all incoming packets and allows all outgoing packets. To set UFW’s default policies:
# ufw default deny incoming
# ufw default allow outgoingStep 4. Open Ports
Next, allow specific protocol connections to reach the server; UFW will block all other connections.
# ufw allow 22/tcp
# ufw allow 80/tcp
# ufw allow 443/tcp
# ufw allow 21/tcpThe commands above will open port 80 (HTTP), 443 (HTTPS), and 21 (FTP). If you want to open another port, simply run:
# ufw allow [PORT_NUMBER]/[PROTOCOL]where [PORT_NUMBER] is a number and [PROTOCOL] is tcp or udp. You can also leave it without a protocol, but we recommend specifying one to avoid opening both TCP and UDP ports unnecessarily.
We can also open a port range; for example, we can open ports between 12000 and 22000:
# ufw allow 12000:22000/tcp
# ufw allow 12000:22000/udpAfter opening the ports, enable UFW.
# ufw enableOnce enabled, you can check the status with:
# ufw statusThat command will return an output like this:
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
21/tcp ALLOW Anywhere
12000:22000/tcp ALLOW Anywhere
12000:22000/udp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443/tcp (v6) ALLOW Anywhere (v6)
21/tcp (v6) ALLOW Anywhere (v6)
12000:22000/tcp (v6) ALLOW Anywhere (v6)
12000:22000/udp (v6) ALLOW Anywhere (v6) Step 5. Install and Configure Fail2Ban
Installing fail2ban is pretty easy, we can just run this command.
# apt install fail2banOnce installed, it should be up and running. Now we can start creating a fail2ban jail. We can copy the Fail2Ban config file, jail.conf, to jail.local using the command cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local. But in this guide, we will create a new file without copying it. Let’s create one.
# nano /etc/fail2ban/jail.localInsert the following into the file:
[sshd]
enabled = yes
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
ignoreip = 192.168.141.152Save the file, then exit.
Explanation:
sshd – the security protocol to be applied
enabled – true, to enable sshd
port – ssh, usually port 22
filter – sshd, can use ufw (optional)
logpath – log location that can be used for monitoring
maxretry – maximum number of attempts before being automatically blocked
bantime – 3600, measured in seconds, meaning if blocked, wait 1 hour for automatic release
ignoreip – whitelist for specific IP addresses to avoid being blockedIf you are running SSH on a different port, simple replace ‘port = ssh’ with ‘port = [PORT_NUMBER]’. To apply the changes, restart fail2ban.
# systemctl restart fail2banNow, can check the number of jails:
# fail2ban-client statusIt will return an output like this:
Status
|- Number of jail: 1
`- Jail list: sshdThere is only one jail, because we created only one jail so far. To check the SSHD jail status, run this command:
# fail2ban-client status sshdYou will see:
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- Journal matches: _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:There is no banned IP so far, you can test it by trying to SSH to your server from another device with incorrect password, that device’s IP address will be banned after 3 failed login attempts. When you try a 4th time, you will see this message on the device you used to test.
ssh: connect to host 192.168.141.152 port 22: Connection refusedNow, you can check the SSHD jail status again:
# fail2ban-client status sshdThis time you will see the banned IP:
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 3
| `- Journal matches: _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
|- Currently banned: 1
|- Total banned: 1
`- Banned IP list: 192.168.141.1Let’s edit our jail.local file to protect our mail server.
# nano /etc/fail2ban/jail.localInsert the following into the file:
[postfix]
enabled = true
port = smtp,465,587
filter = postfix
logpath = /var/log/mail.log
maxretry = 3
bantime = 86400
[postfix-sasl]
enabled = true
port = smtp,465,587,imap,imaps
filter = postfix-sasl
logpath = /var/log/mail.log
maxretry = 3
bantime = 86400Save the file, then exit. Reload fail2ban every time you make changes to a configuration file.
# fail2ban-client reloadStep 6. Integrate Fail2Ban with UFW
By default, Fail2Ban uses iptables rules. To force Fail2Ban to utilize UFW for blocking abusive IP addresses, modify the banaction in your /etc/fail2ban/jail.local file under the section [DEFAULT], it should look like this:
[DEFAULT]
banaction = ufw
banaction_allports = ufwEven when your jail.conf has banaction = iptables-multiport, the one in jail.local will work, because jail.local overrides jail.conf. So, in your /etc/fail2ban/jail.local, you should have these lines now:
[DEFAULT]
banaction = ufw
banaction_allports = ufw
[sshd]
enabled = yes
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
ignoreip = 192.168.141.152
[postfix]
enabled = true
port = smtp,465,587
filter = postfix
logpath = /var/log/mail.log
maxretry = 3
bantime = 86400
[postfix-sasl]
enabled = true
port = smtp,465,587,imap,imaps
filter = postfix-sasl
logpath = /var/log/mail.log
maxretry = 3
bantime = 86400Conclusion
That’s it all! You have learned how to configure Fail2Ban and UFW on Ubuntu 26.04
Of course, you don’t have to configure fail2ban and UFW if you have active monthly server management with us; in that case, you can submit a ticket and ask our expert Linux administrators to configure fail2ban and UFW on Ubuntu 26.04 for you for free. Our system administrators are available 24×7 and will address your request immediately.
If you liked this post about how to configure fail2ban and UFW, please share it with your friends or leave a comment below.
