Fix Fail2ban Not Blocking IPs

What's Actually Happening

Fail2ban fails to block IP addresses after failed authentication attempts. Malicious IPs continue to access services.

The Error You'll See

```bash $ fail2ban-client status sshd

Sorry but the jail 'sshd' does not exist ```

No banned IPs:

```bash Banned IP list:

# Even after multiple failed attempts ```

Filter not matching:

fail2ban.filter  [INFO]: No match found for log line

Backend error:

fail2ban.actions  [ERROR]: Failed to execute ban action

Why This Happens

1. 1.Jail disabled - Jail not enabled in configuration
2. 2.Filter not matching - Regex doesn't match log format
3. 3.Action errors - iptables or firewall commands failing
4. 4.Log path wrong - Incorrect log file path
5. 5.Service not running - Fail2ban daemon stopped
6. 6.Permission denied - Cannot read logs or execute actions

Step 1: Check Fail2ban Status

```bash # Check service: systemctl status fail2ban

# Start service: systemctl start fail2ban

# Check process: ps aux | grep fail2ban

# Check version: fail2ban-server --version

# List jails: fail2ban-client status

# Check specific jail: fail2ban-client status sshd

# Check logs: journalctl -u fail2ban -f

# Fail2ban log: tail -f /var/log/fail2ban.log

# Check configuration: fail2ban-client -d | head -50

# Test configuration: fail2ban-client -t ```

Step 2: Check Jail Configuration

```bash # List enabled jails: fail2ban-client status

# Check jail configuration: cat /etc/fail2ban/jail.local

# Or jail.d: ls -la /etc/fail2ban/jail.d/ cat /etc/fail2ban/jail.d/*.conf

# Enable jail: # In jail.local: [sshd] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 5 bantime = 3600 findtime = 600

# Check if jail enabled: fail2ban-client get sshd enabled

# Reload configuration: fail2ban-client reload

# Or restart: systemctl restart fail2ban

# Test jail regex: fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

# Check jail actions: fail2ban-client get sshd actions ```

Step 3: Fix Filter Configuration

```bash # Check filter file: cat /etc/fail2ban/filter.d/sshd.conf

# Test filter against log: fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

# Expected output: # Lines: 100 lines, 0 ignored, 50 matched

# If no matches: # 1. Check log format # 2. Check regex patterns

# View log file: tail /var/log/auth.log

# Common SSH auth lines: # Failed password for root from 192.168.1.100 port 22 ssh2 # Invalid user test from 192.168.1.100 port 22

# Check failregex: cat /etc/fail2ban/filter.d/sshd.conf | grep failregex

# Add custom regex: # In /etc/fail2ban/filter.d/sshd.local: [Definition] failregex = ^Failed password for .* from <HOST> port \d+ ^Invalid user .* from <HOST> port \d+

# Test new regex: fail2ban-regex /var/log/auth.log 'Failed password for .* from <HOST>'

# Debug filter: fail2ban-regex -v /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf ```

Step 4: Check Log Path

```bash # Check configured log path: fail2ban-client get sshd logpath

# Common log paths: # Debian/Ubuntu: /var/log/auth.log # RHEL/CentOS: /var/log/secure

# Check log file exists: ls -la /var/log/auth.log

# Check log permissions: ls -la /var/log/auth.log

# Fail2ban needs read access: chmod 644 /var/log/auth.log

# Check log content: tail -f /var/log/auth.log

# For multiple logs: logpath = /var/log/auth.log /var/log/auth.log.1

# Or use wildcard: logpath = /var/log/auth.log*

# Check log rotation: # Logs may be rotated and old logs ignored cat /etc/logrotate.conf | grep auth

# Check systemd journal: # If using systemd backend: backend = systemd

# Test journal access: journalctl -u ssh -n 20 ```

Step 5: Check Actions

```bash # Check action configuration: fail2ban-client get sshd actions

# Default action: action = %(action_)s

# action_ typically uses iptables

# Check iptables rules: iptables -L -n | grep f2b

# Expected: # Chain f2b-sshd (1 references) # f2b-sshd tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22

# Check action file: cat /etc/fail2ban/action.d/iptables.conf

# Manual ban test: fail2ban-client set sshd banip 192.168.1.100

# Check if banned: fail2ban-client get sshd banip

# Check iptables: iptables -L f2b-sshd -n

# Unban test: fail2ban-client set sshd unbanip 192.168.1.100

# Check for action errors: grep -i "action|error" /var/log/fail2ban.log | tail -20 ```

Step 6: Fix Permission Issues

```bash # Check fail2ban user: id fail2ban

# Check socket: ls -la /var/run/fail2ban/

# Fix socket permissions: chown fail2ban:fail2ban /var/run/fail2ban/

# Check log permissions: ls -la /var/log/fail2ban.log

# Fix log permissions: chown fail2ban:fail2ban /var/log/fail2ban.log chmod 644 /var/log/fail2ban.log

# Check auth log permissions: ls -la /var/log/auth.log

# Fail2ban needs read access: chmod 644 /var/log/auth.log

# Add fail2ban to adm group: usermod -a -G adm fail2ban

# Check database: ls -la /var/lib/fail2ban/fail2ban.sqlite3

# Fix database permissions: chown fail2ban:fail2ban /var/lib/fail2ban/fail2ban.sqlite3

# Check action execution: # Test iptables command: iptables -I INPUT -s 192.168.1.100 -j DROP

# If iptables fails, check firewall: iptables -L -n ```

Step 7: Check Ban Settings

```bash # Check ban settings: fail2ban-client get sshd bantime fail2ban-client get sshd findtime fail2ban-client get sshd maxretry

# Configure ban settings: [sshd] enabled = true bantime = 3600 # 1 hour findtime = 600 # 10 minutes maxretry = 5 # 5 attempts

# Permanent ban: bantime = -1

# Progressive ban: bantime = 3600 bantime.increment = true bantime.factor = 2

# Check banned IPs: fail2ban-client get sshd banip

# Ban manually: fail2ban-client set sshd banip 192.168.1.100

# Unban: fail2ban-client set sshd unbanip 192.168.1.100

# Check ban history: grep "Ban" /var/log/fail2ban.log | tail -20 ```

Step 8: Debug Jail Issues

```bash # Enable debug logging: # In /etc/fail2ban/fail2ban.conf: loglevel = DEBUG

# Restart: systemctl restart fail2ban

# Watch debug logs: tail -f /var/log/fail2ban.log

# Test filter in detail: fail2ban-regex -v /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

# Check for specific log line: grep "Failed password" /var/log/auth.log | tail -5

# Manual filter test: fail2ban-regex 'Failed password for root from 192.168.1.100' 'Failed password for .* from <HOST>'

# Check jail database: sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 "SELECT * FROM bans LIMIT 10;"

# Check fail2ban-client commands: fail2ban-client -h

# Get all jail settings: fail2ban-client get sshd ```

Step 9: Fix Common Issues

```bash # Jail not working:

# 1. Check enabled: grep enabled /etc/fail2ban/jail.local

# 2. Check logpath correct: fail2ban-client get sshd logpath

# 3. Test filter: fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

# IP not being banned:

# 1. Check if IP matches ignoreip: fail2ban-client get sshd ignoreip

# 2. Remove from ignoreip: ignoreip = 127.0.0.1/8

# 3. Check maxretry reached: grep "192.168.1.100" /var/log/auth.log | wc -l

# 4. Check findtime window: fail2ban-client get sshd findtime

# Ban action not working:

# 1. Check iptables: iptables -L -n | grep f2b

# 2. Test manual iptables: iptables -I INPUT -s 192.168.1.100 -j DROP

# 3. Check action configuration: cat /etc/fail2ban/action.d/iptables.conf

# 4. Use different action: action = iptables-allports ```

Step 10: Fail2ban Verification Script

```bash # Create verification script: cat << 'EOF' > /usr/local/bin/check-fail2ban.sh #!/bin/bash

echo "=== Fail2ban Service ===" systemctl status fail2ban 2>/dev/null | head -5 || echo "Service not running"

echo "" echo "=== Process ===" ps aux | grep fail2ban | grep -v grep || echo "No fail2ban process"

echo "" echo "=== Active Jails ===" fail2ban-client status 2>/dev/null || echo "Cannot get status"

echo "" echo "=== Jail Details ===" for jail in $(fail2ban-client status 2>/dev/null | grep "Jail list" | sed 's/.*:\s*//' | tr ',' ' '); do jail=$(echo $jail | tr -d ' ') if [ -n "$jail" ]; then echo "=== $jail ===" fail2ban-client status $jail 2>/dev/null || true fi done

echo "" echo "=== SSH Jail Configuration ===" cat /etc/fail2ban/jail.local 2>/dev/null | grep -A 10 "[sshd]" || cat /etc/fail2ban/jail.d/*.conf 2>/dev/null | grep -A 10 "[sshd]" || echo "No sshd jail configured"

echo "" echo "=== Filter Test ===" if [ -f /var/log/auth.log ]; then fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf 2>&1 | tail -10 elif [ -f /var/log/secure ]; then fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/sshd.conf 2>&1 | tail -10 else echo "No auth log found" fi

echo "" echo "=== iptables Rules ===" iptables -L -n 2>/dev/null | grep -E "f2b|fail2ban" || echo "No fail2ban iptables rules"

echo "" echo "=== Recent Bans ===" grep -i "Ban|Unban" /var/log/fail2ban.log 2>/dev/null | tail -10 || echo "No ban history"

echo "" echo "=== Log Permissions ===" ls -la /var/log/auth.log /var/log/fail2ban.log 2>/dev/null || echo "Log files not found"

echo "" echo "=== Recommendations ===" echo "1. Ensure fail2ban service is running" echo "2. Verify jail is enabled in configuration" echo "3. Check filter matches log format" echo "4. Confirm correct logpath for your system" echo "5. Verify iptables rules are created" echo "6. Check log file permissions" echo "7. Enable debug logging for detailed troubleshooting" EOF

chmod +x /usr/local/bin/check-fail2ban.sh

# Usage: /usr/local/bin/check-fail2ban.sh ```

Fail2ban Blocking Checklist

Verify the Fix

```bash # After fixing Fail2ban

# 1. Check service systemctl status fail2ban // Active running

# 2. Check jails fail2ban-client status // Jails listed

# 3. Test filter fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf // Matches found

# 4. Manual ban test fail2ban-client set sshd banip 192.168.1.100 fail2ban-client get sshd banip // IP listed

# 5. Check iptables iptables -L f2b-sshd -n // Rule exists

# 6. Monitor logs tail -f /var/log/fail2ban.log // Ban actions logged ```

Related Issues

• [Fix SSH Connection Refused](/articles/fix-ssh-connection-refused)
• [Fix iptables Rules Not Persisting](/articles/fix-iptables-rules-not-persisting)
• [Fix Nginx Rate Limit Blocking Legitimate](/articles/fix-nginx-rate-limit-blocking-legitimate)