Fail2ban UI Dashboard

Sign in to Fail2ban UI

Please authenticate to access the management interface

Secure authentication via OpenID Connect

Select a Filter

Filter Content

Filter content is shown read-only. Click 'Edit' to modify for testing. Changes are temporary and not saved.

Log Lines

General Settings

Language

Server Port

Fail2ban Callback URL

This URL is used by all Fail2Ban instances to send ban alerts back to Fail2Ban UI. For local deployments, use the same port as Fail2Ban UI (e.g., http://127.0.0.1:8080). For reverse proxy setups, use your TLS-encrypted endpoint (e.g., https://fail2ban.example.com).

Fail2ban Callback URL Secret show secret

This secret is automatically generated and used to authenticate ban notification requests. It is included in the fail2ban action configuration.

Enable Debug Log

Enable Console Output

Advanced Actions for Recurring Offenders

Automatically add recurring offenders to an external firewall once they hit a specific threshold.

Enable automatic permanent blocking

Threshold before permanent block

If an IP is banned at least this many times it will be forwarded to the selected firewall integration.

Integration

Choose where permanent bans should be synchronized.

Permanent Block Log

No permanent blocks recorded yet.

Alert Settings

Email Alert Preferences

Enable email alerts for bans Enable email alerts for unbans

Destination Email (Alerts Receiver)

GeoIP Provider

Choose the GeoIP lookup provider. MaxMind requires a local database file, while Built-in uses a free online API.

GeoIP Database Path

Path to the MaxMind GeoLite2-Country database file.

Maximum Log Lines

Maximum number of log lines to include in ban notifications. Most relevant lines are selected automatically.

Alert Countries

Choose the countries for which you want to receive email alerts when a block is triggered.

SMTP Configuration

SMTP Host

SMTP Port

Common ports: 25 (plain), 587 (STARTTLS), 465 (SMTPS), 2525 (alternative STARTTLS)

SMTP Username

SMTP Password

Sender Email

Authentication Method

Use TLS (Recommended)

Skip TLS Certificate Verification ⚠️ Not recommended for production

⚠️ Please save your SMTP settings first before sending a test email.

Global Default Fail2Ban Configurations

These settings will be applied to all enabled Fail2Ban servers and stored in their jail.local [DEFAULT] section.

Enable Bantime Increment

If set to true, the bantime will be calculated using the formula: bantime = findtime * (number of failures / maxretry) * (1 + bantime.rndtime).

Enable Jails by Default

If enabled, all jails will be enabled by default. When disabled, jails must be explicitly enabled.

Default Bantime

The number of seconds that a host is banned. Time format: 1h = 1 hour, 1d = 1 day, 1w = 1 week, 1m = 1 month, 1y = 1 year.

Bantime Rndtime

Optional. Max random seconds added in bantime increment formula (e.g. 2048). Leave empty to use Fail2ban default.

Banaction

Default banning action (e.g. nftables-multiport, nftables-allports, firewallcmd-rich-rules, etc). It is used to define action_* variables.

Banaction Allports

Banning action for all ports (e.g. iptables-allports, firewallcmd-allports, etc). Used when a jail needs to ban all ports instead of specific ones.

Default Chain

iptables/nftables chain used for banning (e.g. INPUT for host, DOCKER-USER for Docker containers).

Default Findtime

A host is banned if it has generated 'maxretry' failures during the last 'findtime' seconds. Time format: 1h = 1 hour, 1d = 1 day, 1w = 1 week, 1m = 1 month, 1y = 1 year.

Default Max Retry

Number of failures before a host gets banned.

Ignore IPs

Space separated list of IP addresses, CIDR masks or DNS hosts. Fail2ban will not ban a host which matches an address in this list.

Filter Config:

Filter Configuration

Jail Configuration

Create New Jail

Jail Name

Only alphanumeric characters, dashes, and underscores are allowed.

Filter (optional)

Selecting a filter will auto-populate the jail configuration.

Jail Configuration

Jail configuration will be auto-populated when you select a filter.

Create New Filter

Filter Name

Only alphanumeric characters, dashes, and underscores are allowed.

Filter Configuration (optional)

If left empty, an empty filter file will be created.

Manage Fail2ban Servers

Registered Servers

Add or Update Server

Display Name

Connection Type

Hostname / IP

Port

Fail2ban Socket Path

Fail2ban Log Path

Server Hostname

SSH User

Select Private Key

SSH Private Key Path

Place your SSH private key in the /config/.ssh/ directory (mounted config volume). The key file must have permissions 600 (chmod 600). Example: /config/.ssh/id_rsa

Agent URL

Agent Secret

Manually Block / Test

IP address

Ban Insights

Country distribution and recurring offenders.

Bans by country

Top origins for the selected time range.

Geo

Recurring IPs

IP addresses repeatedly triggering Fail2ban.

Watchlist

Default chain

DOCKER-USER: Use for apps running in Docker. Bans apply to all containers on the host.
INPUT: Use for apps on the host. Bans apply to the host network only, not Docker networks.
FORWARD: Only for older Docker setups where DOCKER-USER is not available.