# fail2ban

29 Hacker News commenters recommended fail2ban and 25 criticized it, November 2025 to November 2026. It was recommended in 9 of 13 months.

**Verdict:** Free tool that bans IPs after repeated failed logins or bad requests, mainly cutting log noise and blocking simple brute-force attempts. Critics say it does little against large botnets.

## Why people recommend it

- Easy setup, runs unattended (5 comments): "it does what it's supposed to do and I don't ask it to do more" ([source](https://news.ycombinator.com/item?id=48913860)) "I just use fail2ban and it seems to do a pretty good job" ([source](https://news.ycombinator.com/item?id=49062753)) "Set up fail2ban and just forget about it." ([source](https://news.ycombinator.com/item?id=46639010))
- Cleaner logs, less noise (3 comments): "set up fail2ban with the recidive jail to at least reduce the size of your daily server report email" ([source](https://news.ycombinator.com/item?id=47959186)) "If nothing else to decrease the amount of junk in logs." ([source](https://news.ycombinator.com/item?id=47738823)) "Fail2ban would cut down on the noise quite a bit." ([source](https://news.ycombinator.com/item?id=47036064))
- Stops repeated SSH login attempts (3 comments): "fail2ban on the server completely stopped those pesky ssh log in attempts" ([source](https://news.ycombinator.com/item?id=47762678)) "You can tweak rate thresholds for F2B, so that it blocks the 100-attempts-per-second attackers" ([source](https://news.ycombinator.com/item?id=46587435)) "Fail2ban also helps block repeated attempts like that." ([source](https://news.ycombinator.com/item?id=46896025))
- Cuts bot crawling on web logs (3 comments): "setup fail2ban to ban any IP accessing those URLs and you'll get rid of 99% of the crawling" ([source](https://news.ycombinator.com/item?id=45928026)) "Personally, I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours" ([source](https://news.ycombinator.com/item?id=49076034)) "Fail2ban has decent jails for Apache httpd." ([source](https://news.ycombinator.com/item?id=46980082))

## What people warn about

- Weak against large botnets (2 comments): "that's dinosaur software from the palaeolithic. If you have a website of any size then the number of bots will overwhelm the block list in days" ([source](https://news.ycombinator.com/item?id=49284169)) "Fail2ban doesn’t work well against residential bot nets." ([source](https://news.ycombinator.com/item?id=50078771))
- Adds CPU and disk load (3 comments): "fail2ban currently eats ~25% CPU and started thinking if it's even worth running at this point" ([source](https://news.ycombinator.com/item?id=49518405)) "Gitea and Fail2ban are resource hogs in your case, either unoptimized or poorly configured." ([source](https://news.ycombinator.com/item?id=45946545)) "fail2ban became the top process by bytes written in iotop" ([source](https://news.ycombinator.com/item?id=46249817))
- Mostly tidies logs, little security (3 comments): "all it does is give you a cleaner log file since by definition its working on logs for attacks/attempts that did not succeed" ([source](https://news.ycombinator.com/item?id=46309775)) "fail2ban is 100% placebo and does nothing except clean up the logs a bit" ([source](https://news.ycombinator.com/item?id=49307925)) "fail2ban seems like security theater for a keys-only SSH server" ([source](https://news.ycombinator.com/item?id=46899930))
- Bans legitimate users and VPNs (3 comments): "it didn't help much due to the larger number of IPs, 2) it blocked widely used VPN services" ([source](https://news.ycombinator.com/item?id=48872330)) "F2B has banned me in the past due to various oopsies on my part." ([source](https://news.ycombinator.com/item?id=46582805)) "fail2ban keeps banning me after one failed password entry" ([source](https://news.ycombinator.com/item?id=47425236))

## Alternatives hackers recommend

- [CrowdSec](https://hackerapproved.com/p/crowdsec.md): 11 recommend

## Cite as

Hacker Approved, "fail2ban", https://hackerapproved.com/p/fail2ban/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).