Fail2ban Filter Generator

fail2ban reads logs, looks for lines indicating a failed attempt and bans the source address once they repeat. The filter is what does the recognising: a file holding one or more regular expressions. Writing that file is where most configurations stall, because a regex matching nothing raises no error — it simply never bans anybody.

Enter the filter name and the expressions and the page assembles the file, already carrying the path where it should be saved and the line referencing it from the jail. The detail that decides everything is the host marker: fail2ban replaces that tag with the pattern recognising IPv4 and IPv6 addresses, and that is where it takes the address to ban from. A regex without that marker matches the line but identifies nobody.

Test before shipping. fail2ban's test command takes a log file and a filter and reports how many lines matched and which addresses were extracted — it is the difference between finding the mistake now or three weeks from now, when someone asks why nobody was ever banned. It also pays to take ignoreregex seriously so you do not ban yourself: monitoring and health checks produce exactly the kind of line the filter looks for.