Free tools

fail2ban config checker

Paste your fail2ban configuration and see which jails run, what each one bans and for how long, and the mistakes that leave fail2ban running without protecting anything.

Runs in your browser. What you paste or open is read by this page and goes nowhere: it is not uploaded, not stored and not sent to analytics. The page counts one anonymous “tool used” event with the tool’s name and nothing else. You can check by opening your browser’s network tab, or by going offline after the page loads.
Best input: the configuration fail2ban actually resolved
sudo fail2ban-client -d
Or paste your own files, together if you like
sudo cat /etc/fail2ban/jail.local /etc/fail2ban/jail.d/*.local

fail2ban-client -d prints every enabled jail with every value resolved, after jail.conf, jail.d and the paths file for your distribution have all been applied, the way sshd -T does for SSH. A pasted file is checked as written, and a value it does not set is shown as fail2ban’s stock default and marked as assumed.

What it checks

  • Exemptions that cover everyone: an ignoreip of 0.0.0.0/0 or ::/0, or a large public range.
  • Jails that are not running: no enabled jail, no SSH jail, or enabled = true in [DEFAULT], which switches on jails for services you do not run and can stop fail2ban from starting.
  • Limits that do not limit: high maxretry, very short findtime or bantime, and permanent bans.
  • Reading the wrong thing: a jail reading /var/log/auth.log where it does not exist, or a Debian log path paired with a RHEL firewall action.
  • Trusting what attackers control: usedns = yes, ignoreself = false.
  • Coverage: no recidive jail for repeat offenders, and SSH bans limited to port 22.
  • Maintenance: edits made in jail.conf, which an upgrade replaces, and settings defined twice.

Recognised either way: a jail called sshd, Plesk’s ssh, or any jail using the sshd filter counts as the SSH jail. Time values are read the way fail2ban reads them (600, 10m, 1h30m, 1w, -1).

Related

Why fail2ban is not blocking attacksEach cause, with the command that proves itauth.log analyzerWhat fail2ban should be seeingSSH config checkerMake the guessing pointless: keys onlyfail2ban alternativesCrowdSec, SSHGuard and others, comparedSecAI and fail2banWhat each does, and running both

Questions

Should I paste jail.local or the fail2ban-client -d output?

The output of sudo fail2ban-client -d, when you can. It is fail2ban's own dump of the configuration it resolved after reading jail.conf, every file in jail.d and the paths file for your distribution, and it lists only the jails that are actually enabled. A pasted jail.local is checked too, but any value it does not set comes from files this page cannot see, and the result says which values it assumed.

Is my configuration uploaded?

No. The checker runs in your browser; there is no request containing what you paste, and nothing is stored or sent to analytics. The page counts one anonymous "tool used" event with the tool's name only.

Why is fail2ban running but not banning anything?

The common causes, in order: the jail is not enabled; the jail reads a log file that does not exist (on Debian 12 and later there is no /var/log/auth.log without rsyslog, so the sshd jail needs backend = systemd); your ignoreip covers the attackers; the ban action does not match the firewall the server runs; or SSH listens on a port the ban does not cover. The guide linked below walks through each with the command that proves it.

What are sensible values for the SSH jail?

maxretry between 3 and 5, findtime of 10 minutes or more, a bantime of at least 10 minutes with bantime.increment = true so repeat offenders are banned for longer each time, and an ignoreip that lists only your own fixed addresses plus 127.0.0.1/8 and ::1. Permanent bans (bantime = -1) are rarely worth it: they grow the firewall without limit and can lock out a shared office address for good.

How do I check that fail2ban actually works after a change?

sudo fail2ban-client -t tests the configuration without restarting, sudo fail2ban-client status sshd shows the jail's current failures and bans, and fail2ban-regex runs the filter against your real log (sudo fail2ban-regex /var/log/auth.log sshd, or sudo fail2ban-regex systemd-journal sshd on a journal-only system) and prints how many lines matched.