fail2ban on an Anubiz Offshore VPS
fail2ban watches logs for failed logins and bans the source IP at the firewall level. On a public-facing Anubiz VPS the SSH login rate alone justifies running it. This guide configures fail2ban 1.x on Ubuntu 24.04 with the nftables backend (default in 1.x), persistent bans across restart, an allowlist for your jump hosts and additional jails for nginx auth, Postfix SASL and Roundcube.
Need this done for your project?
We implement, you ship. Async, documented, done in days.
Step 1: Install and Allowlist
apt install fail2ban. Create /etc/fail2ban/jail.local with [DEFAULT] ignoreip = 127.0.0.1/8 ::1 198.51.100.0/24 (your jump CIDR), backend = systemd, bantime = 1h, findtime = 10m, maxretry = 5.
Step 2: nftables Backend
fail2ban 1.x ships an nft action. In jail.local set banaction = nftables[type=multiport] and banaction_allports = nftables[type=allports]. This integrates cleanly with the nftables baseline guide.
Step 3: SSH Jail
[sshd] enabled = true mode = aggressive bantime = 24h maxretry = 3. Aggressive mode also catches scanners that disconnect before auth.
Step 4: nginx Auth and Postfix SASL
Enable nginx-http-auth, postfix-sasl, dovecot jails as needed. Each watches the relevant service log. Roundcube jail needs a custom filter pointing at the Roundcube log path.
Step 5: Persistent Bans
Set dbpurgeage = 7d so bans survive fail2ban restart. The SQLite DB in /var/lib/fail2ban/fail2ban.sqlite3 persists across reboot.
Related Services
Why Anubiz Host
Ready to get started?
Skip the research. Tell us what you need, and we'll scope it, implement it, and hand it back — fully documented and production-ready.