Menu

    Fail2Ban Config Generator

    Security & Compliance

    Generate a complete Fail2Ban jail.local configuration with pre-built jails for SSH, Nginx, Apache, Postfix, WordPress, and more.

    Global Defaults

    Jails1 enabled

    SSH (sshd)

    Recommended

    Blocks brute-force SSH login attempts.

    Overrides (leave blank for defaults)

    SSH DDoS

    Blocks SSH connection flooding before authentication.

    Nginx HTTP Auth

    Blocks failed HTTP basic auth attempts on Nginx.

    Nginx Bot Search

    Blocks bots scanning for vulnerable URLs (wp-admin, phpmyadmin, etc).

    Nginx Bad Request

    Blocks clients sending malformed HTTP requests.

    Nginx Rate Limit

    Blocks IPs exceeding Nginx limit_req rate limits.

    Apache Auth

    Blocks failed HTTP auth on Apache.

    Apache Overflows

    Blocks Apache buffer overflow and long request attempts.

    Apache Bad Bots

    Blocks known malicious user-agent strings.

    Postfix SMTP Auth

    Blocks brute-force SMTP authentication attempts.

    Postfix DDoS

    Blocks SMTP connection flooding and dictionary attacks.

    Dovecot

    Blocks brute-force IMAP/POP3 login attempts.

    WordPress Login

    Blocks brute-force wp-login.php attempts via access log.

    WordPress XML-RPC

    Blocks xmlrpc.php abuse used for amplification attacks.

    Companion Firewall Rules

    Optional rate-limiting rules to pair with Fail2Ban as a first line of defense.

    # Fail2Ban jail.local configuration
# Generated by Bit Refinery Tools — 2026-08-01

[DEFAULT]
bantime  = 10m
findtime = 10m
maxretry = 5
banaction = iptables-multiport
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled  = true
filter   = sshd
port     = ssh
logpath  = /var/log/auth.log

    Configuration is generated entirely in your browser. Review generated rules before applying to production systems. Place jail.local in /etc/fail2ban/ and restart the service.