fail2ban
Intrusion prevention tool in Privacy & security
Free tool that bans IPs after repeated failed logins or bad requests, mainly cutting log noise and blocking simple brute-force attempts. Critics say it does little against large botnets.
Free tool that bans IPs after repeated failed logins or bad requests, mainly cutting log noise and blocking simple brute-force attempts. Critics say it does little against large botnets.
54 people gave an opinion
- recommend it
- 29
- criticize it
- 25
- approval share
- 54%
Recommended in 9 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 29 people recommend itNeeds 10 or more, met.
- 1.1 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Easy setup, runs unattended
“it does what it's supposed to do and I don't ask it to do more”
Comment from 14 Jul 2026 in “How the FSF sysadmins block botnets with reaction” “I just use fail2ban and it seems to do a pretty good job”
Comment from 26 Jul 2026 in “How to Block Some of the Bots” “Set up fail2ban and just forget about it.”
Comment from 15 Jan 2026 in “Ask HN: One IP, multiple unrealistic locations worldwide hitting my website” - Comment from 26 Jul 2026 in “How to Block Some of the Bots”
- Comment from 18 Dec 2025 in “I got hacked: My Hetzner server started mining Monero”
Cleaner logs, less noise
“set up fail2ban with the recidive jail to at least reduce the size of your daily server report email”
Comment from 30 Apr 2026 in “Who Is That Knocking at My (SSH) Door?” “If nothing else to decrease the amount of junk in logs.”
Comment from 12 Apr 2026 in “I run multiple $10K MRR companies on a $20/month tech stack” “Fail2ban would cut down on the noise quite a bit.”
Comment from 16 Feb 2026 in “Show HN: Knock-Knock.net – Visualizing the bots knocking on my server's door” Stops repeated SSH login attempts
“fail2ban on the server completely stopped those pesky ssh log in attempts”
Comment from 14 Apr 2026 in “I run multiple $10K MRR companies on a $20/month tech stack” “You can tweak rate thresholds for F2B, so that it blocks the 100-attempts-per-second attackers”
Comment from 12 Jan 2026 in “2026 is the Year of Self-hosting” “Fail2ban also helps block repeated attempts like that.”
Comment from 5 Feb 2026 in “Ask HN: Is Connecting via SSH Risky?” Cuts bot crawling on web logs
“setup fail2ban to ban any IP accessing those URLs and you'll get rid of 99% of the crawling”
Comment from 14 Nov 2025 in “Magit manuals are available online again” “Personally, I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours”
Comment from 27 Jul 2026 in “How to Block Some of the Bots” “Fail2ban has decent jails for Apache httpd.”
Comment from 11 Feb 2026 in “Thank You, AI”
What people warn about
Each mark is one comment
Weak against large botnets
“that's dinosaur software from the palaeolithic. If you have a website of any size then the number of bots will overwhelm the block list in days”
Comment from 13 Aug 2026 in “Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot” “Fail2ban doesn’t work well against residential bot nets.”
Comment from 13 Oct 2026 in “I posted to HN, and then my website was flooded with AI bot traffic” Adds CPU and disk load
“fail2ban currently eats ~25% CPU and started thinking if it's even worth running at this point”
Comment from 1 Sep 2026 in “Creepy Crawlies” “Gitea and Fail2ban are resource hogs in your case, either unoptimized or poorly configured.”
Comment from 16 Nov 2025 in “The internet is no longer a safe haven” “fail2ban became the top process by bytes written in iotop”
Comment from 12 Dec 2025 in “Guarding My Git Forge Against AI Scrapers” Mostly tidies logs, little security
“all it does is give you a cleaner log file since by definition its working on logs for attacks/attempts that did not succeed”
Comment from 18 Dec 2025 in “I got hacked: My Hetzner server started mining Monero” “fail2ban is 100% placebo and does nothing except clean up the logs a bit”
Comment from 15 Aug 2026 in “I close SSH port 22 (and what I use instead)” “fail2ban seems like security theater for a keys-only SSH server”
Comment from 5 Feb 2026 in “Ask HN: Is Connecting via SSH Risky?” Bans legitimate users and VPNs
“it didn't help much due to the larger number of IPs, 2) it blocked widely used VPN services”
Comment from 11 Jul 2026 in “An Update on the scraper situation” “F2B has banned me in the past due to various oopsies on my part.”
Comment from 12 Jan 2026 in “2026 is the Year of Self-hosting” “fail2ban keeps banning me after one failed password entry”
Comment from 18 Mar 2026 in “SSH has no Host header”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| fail2banThis page | 29 | 25 | 54% | 9 | — | — |
| CrowdSec | 11 | 10 | 52% | 6 | — | — |
What people said
40 of the 58 comments that mention it, newest first. Each links to the original comment.
“Fail2ban doesn’t work well against residential bot nets.”
“fail2ban runs in the background to limit abuse”
“fail2ban currently eats ~25% CPU and started thinking if it's even worth running at this point”
“Fail2ban, port knocking, magic packets, setting custom port are basically toys for wasting time.”
“It's a simple and a very effective heuristic to block both non-offending port-scans and offending too.”
“fail2ban is 100% placebo and does nothing except clean up the logs a bit”
“that's dinosaur software from the palaeolithic. If you have a website of any size then the number of bots will overwhelm the block list in days”
“Personally, I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours”
“I just use fail2ban and it seems to do a pretty good job”
“it seems to do a pretty good job”
“fail2ban and some http 444 helps out.”
“it does what it's supposed to do and I don't ask it to do more”
“it didn't help much due to the larger number of IPs, 2) it blocked widely used VPN services”
“You might introduce even more attack surface in pursuit of this "security" measure by installing additional software like fail2ban”
“You'd be surprised how effective that is.”
“set up fail2ban with the recidive jail to at least reduce the size of your daily server report email”
“fail2ban on the server completely stopped those pesky ssh log in attempts”
“If nothing else to decrease the amount of junk in logs.”
“Using SSH keys + fail2ban means that for a simple static site, it will be sufficient for a decade at least.”
“Fail2ban doesn't scale well to these volumes of traffic and request patterns.”
“fail2ban keeps banning me after one failed password entry”
“Fail2ban would cut down on the noise quite a bit.”
“And after that: sweet silence.”
“Fail2ban has decent jails for Apache httpd.”
“fail2ban seems like security theater for a keys-only SSH server”
“When they improve, there's always fail2ban.”
“Fail2ban also helps block repeated attempts like that.”
“Set up fail2ban and just forget about it.”
“You can tweak rate thresholds for F2B, so that it blocks the 100-attempts-per-second attackers”
“F2B has banned me in the past due to various oopsies on my part.”
“fail2ban - it is still worthwhile even in the age of the massively distributed botnet”
“Just use subpath routing and fail2ban and Im very comfortable with exposing my home setup to the world.”
“in which case you may want to deploy Fail2Ban”
“Fail2Ban rules, like you mentioned, will reduce your attack surface”
“all it does is give you a cleaner log file since by definition its working on logs for attacks/attempts that did not succeed”
“Honestly fail2ban is amazing.”
“fail2ban became the top process by bytes written in iotop”
“Gitea and Fail2ban are resource hogs in your case, either unoptimized or poorly configured.”
“something like fail2ban or crowdsec would probably be more effective here”
“setup fail2ban to ban any IP accessing those URLs and you'll get rid of 99% of the crawling”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.