# Fail2ban

Fail2ban is a daemon that monitors log files and automatically bans hosts that cause multiple authentication failures, using firewall rules to block further access, helping administrators and self-hosters defend. It is open source and self-hosted, installable on Docker Hub and Unraid.

Canonical page: https://ourlocalhost.com/app/1108/fail2ban

## Description

Fail2ban is a daemon that monitors log files and automatically bans hosts that cause multiple authentication failures, using firewall rules to block further access, helping administrators and self-hosters defend servers against brute-force attacks.

## Platform availability

Available on 2 of 9 platforms: Unraid, ZimaOS.

## Health score

72/100 (Good), based on 4 of 4 factors.
- Maintained: 98 (last commit 28 days ago)
- Popular: 40 (98 GitHub stars)
- Easy to install: 45 (2 install platforms, install notes, Docker image)
- Light to run: 95 (500 MB minimum RAM, runs on ARM)

## Links

- Docker Hub: https://hub.docker.com/r/crazymax/fail2ban
- GitHub: https://github.com/linuxserver/docker-fail2ban
- Unraid: https://ca.unraid.net/apps/fail2ban-023q0a60zxp2z6?q=fail2ban
- Official website: http://www.fail2ban.org

## Common questions

### Why can Fail2Ban ban an IP but the original IP still connect when using Cloudflare?

If the server is behind Cloudflare, the server sees Cloudflare addresses instead of the client's original address. Fail2ban may ban the Cloudflare address, while the original IP can still connect through the proxy.

### Why does Fail2Ban stop protecting the system after a reboot?

The fail2ban service must be enabled so it starts after a reboot. On CentOS/RHEL, use systemctl start fail2ban and systemctl enable fail2ban; otherwise protection can be lost after a restart.

### Can Fail2Ban reduce resource usage from repeated failed login attempts?

Yes, dropping all requests from an IP after N failed login attempts uses fewer resources than processing those attempts indefinitely. At scale, this can make a difference against DDoS-like repeated request pressure.

## Alternatives

- CrowdSec: CrowdSec is a free, open-source IDS/IPS and WAF that detects malicious behavior by analyzing server logs and HTTP requests, then blocks off…
- defensia-agent

---
Source: Our Local Host (https://ourlocalhost.com/app/1108/fail2ban), the self-hosted and open-source app directory.