Fail2Ban Useful Commands Cheat Sheet

This page outlines essential fail2ban-client commands to help monitor, manage, and interact with Fail2Ban jails. These are especially useful when securing SSH access or reviewing suspicious login attempts.

📊 General Status Overview

sudo fail2ban-client status

Lists all active jails and global stats.

🔎 Check a Specific Jail (e.g., SSH)

sudo fail2ban-client status sshd

Returns:

Current failed attempts
Total failed attempts
Currently banned IPs
Log file being watched

📋 List Banned IPs

sudo fail2ban-client get sshd banned

Displays all IP addresses currently banned for that jail.

⏱️ Check Ban Duration

sudo fail2ban-client get sshd bantime

Outputs the current bantime (in seconds) configured for the jail.

🔄 Unban an IP

sudo fail2ban-client set sshd unbanip <ip-address>

Manually remove a banned IP from the list.

🪵 View Real-Time Ban Events

sudo tail -f /var/log/fail2ban.log

Use this to monitor login failures and ban actions in real time.

🔁 Restart Fail2Ban

sudo systemctl restart fail2ban

Restart the Fail2Ban service after modifying configs or jail files.