How to block IP scans on the network with fail2ban and nftables

Learn how to secure your network edge against automated IP scans and intrusion attempts by combining the fail2ban log monitor with the modern nftables firewall.

Marcio Cunha•5 min

Also available in:Português Español

Summary

Automated IP scans constantly probe open ports and vulnerable services on servers exposed to the public internet.
Fail2ban acts as a vigilant monitor that reads system logs in real time to identify suspicious behavior patterns.
Nftables replaces legacy iptables with faster rules structured in native IP address sets for maximum efficiency.
Integrating both tools allows administrators to drop malicious IPs directly inside the Linux kernel with top performance.
Monitoring traffic and tuning ban durations prevents false positives without compromising legitimate user access.

The invisible danger of IP scans on the internet

Keeping a server connected to the internet is like leaving your house window open on a busy street. Automated bots constantly perform IP scans, firing data packets to test which ports are open and what operating systems or services are running there. In practice, this means your IP address receives hundreds of intrusion attempts per day, often originating from distributed botnets worldwide. Ignoring this constant background noise creates openings for attackers to find forgotten flaws or use brute-force methods to guess passwords.

To protect servers against this flood of malicious traffic, modern network engineering requires edge security—stopping threats before they reach core applications. If you have already secured remote access as explained in our guide on how to block SSH brute force attacks with Fail2Ban, you know that log monitoring is essential. However, monitoring alone is not enough; you need a fast and efficient firewall barrier to drop unwanted packets before they consume critical CPU resources.

Before implementing complex network filters, it is wise to ensure the basic server hardware is stable, verifying power stability or motherboard conditions, topics we cover when explaining how to test the 12V rail on a power supply with a multimeter. With healthy hardware in place, we can focus entirely on the logical security layer.

How fail2ban identifies threats in real time

Fail2ban is software written in Python that monitors your server log files for repetitive failure patterns, such as login errors or suspicious connection requests. When an IP address exceeds a predefined error threshold within a short timeframe, the program recognizes it as a scanning script or an intruder testing credentials rather than a distracted user. It then triggers external commands to ban that IP for a specific duration.

In practice, fail2ban acts like an attentive bouncer watching a denied-entry list, recording every failed login attempt. By offloading these dynamic blocks to the underlying packet filter, the server maintains high availability even under intense scanning campaigns from multiple sources across the globe.

The evolution of firewalls with nftables

For many years, iptables was the market standard in Linux for filtering network packets and creating firewall rules. However, with growing traffic volumes and network complexity, iptables showed performance limitations, requiring long rule chains that overloaded the operating system kernel. Nftables emerges as the modern replacement, unifying packet filtering under a cleaner, faster syntax capable of processing thousands of blocks without lag.

Unlike its predecessor, nftables deals with native data sets and tables, allowing administrators to group thousands of malicious IPs into a single optimized lookup structure. This drastically reduces RAM consumption and CPU usage when fail2ban adds or removes banned addresses. For those dealing with advanced packet filtering, transitioning to nftables provides an expressive operational efficiency boost at the network edge.

If you want to understand more about the foundations of modern filtering, check out our recommendations in the article about how to block malicious network packets with iptables, which serves as a conceptual bridge to understand how network hooks operate inside Linux.

Configuring the integration between fail2ban and nftables

To make this duo work together, we must configure fail2ban to use native nftables actions instead of legacy iptables commands. This integration ensures bans are applied directly within kernel tables, dropping traffic at the lowest possible layer of the network stack. The first step is verifying that nftables is installed and active on your Linux operating system.

In the main fail2ban configuration file, typically located at /etc/fail2ban/jail.local, we define which firewall backend will handle protection rules. Below is a functional configuration example directing ban actions to nftables to optimize server performance against unwanted IP scans.

[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
banaction = nftables-multiport

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = systemd

This block sets fundamental parameters: a standard one-hour ban time (bantime), a ten-minute observation window for error counting (findtime), and a maximum limit of five failed attempts (maxretry) before closing the port to that IP address. Using banaction = nftables-multiport instructs fail2ban to utilize dynamic nftables sets for clean and scalable block management.

Step-by-step guide to activate and test edge blocking

To put the system into operation, follow these steps in your Linux server terminal with administrative privileges. Make sure necessary packages are installed in your distribution and the firewall service is enabled to start automatically upon boot.

Install fail2ban and nftables packages using your distribution package manager, such as apt on Ubuntu or Debian:
```
sudo apt update && sudo apt install fail2ban nftables -y
```
Create the local configuration file by copying the default template and adjusting ban rules for nftables as described previously:
```
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
```
Start and enable services to ensure they monitor traffic and enforce security rules automatically after every reboot:
```
sudo systemctl enable --now nftables fail2ban
```

After completing these steps, you can check the current status of fail2ban jails by running sudo fail2ban-client status in your terminal. To inspect active nftables rules, use sudo nft list ruleset to view blocked IP sets in real time.

Final considerations on security and continuous monitoring

Implementing fail2ban alongside nftables is one of the most efficient ways to quiet the noise of IP scans and automated intrusion attempts at your network edge. This combination reduces computing overhead and shields essential services against constant abuse from the open internet. However, digital security is an ongoing process requiring periodic log audits and fine-tuning of ban durations to prevent accidental lockouts of legitimate users.

Keeping systems updated, monitoring network behavior, and regularly testing server integrity ensures a resilient environment prepared to absorb attacks without business disruption. By adopting these practices, you transform a vulnerable infrastructure into a modern, high-performance digital fortress.