Fail2Ban Actions
Fail2Ban actions define what happens when an IP address is banned or unbanned. Actions are the commands that Fail2Ban executes in response to detected malicious activity, such as adding firewall rules, sending notifications, or reporting to external services.
Overview
URL: /admin/fail2ban-actions
The Actions page is divided into two sections: Custom Actions that you can create, edit, and delete, and Local Actions that are pre-installed with Fail2Ban and available as read-only templates.
Custom Actions
Custom actions are user-created configurations that you can fully manage.
Table Columns
| Column | Description |
|---|---|
| Name | The unique identifier for the action (sortable). |
| Created at | When the action was created (e.g. 3 weeks ago). |
| Actions | Edit and Delete buttons for managing the action. |
Action Buttons
- New Fail2BanAction - opens the creation form for a new custom action
- Search - filter actions by name
Pagination
You can adjust the number of actions displayed per page: 5, 10, 25, 50, or All.
Local Actions
Local actions are pre-installed Fail2Ban action configurations provided by the system. These are read-only and cannot be edited directly. You can use them as templates when creating custom actions by clicking View action, which opens the creation form pre-filled with the local action's configuration.
The Local Actions table displays:
| Column | Description |
|---|---|
| Name | The name of the local action. |
| View action | Opens the creation form pre-filled with this action's configuration. |
Local actions include integrations for firewall management, external reporting services, and notification systems. Some commonly available local actions include: abuseipdb, apf, apprise, blocklist_de, cloudflare, cloudflare-token, dshield, firewallcmd-allports, firewallcmd-common, iptables, nftables, sendmail, among others.
Create Action
URL: /admin/fail2ban-actions/create
To create a new action, click New Fail2BanAction or click View action on a local action to use it as a template.
Fields
| Field | Description |
|---|---|
| Local Action Profile | Dropdown to select a local action as a template. This pre-fills the Action Name and Content fields. |
| Action Name | A unique identifier for the action (required). For example: iptables-custom. |
| Content | The action configuration in Fail2Ban's action format, defining actionstart, actionstop, actionban, and actionunban commands. |
The Content field uses Fail2Ban's standard action configuration syntax with sections like [Definition] and options such as actionstart, actionstop, actionban, and actionunban.
Buttons
- Create - saves the new action
- Create & create another - saves the action and opens a blank form for creating another
- Cancel - returns to the actions list without saving
Edit Action
Clicking Edit on a custom action opens the same form with the current values pre-filled. After making changes, click Save Changes to apply them.
Delete Action
Clicking Delete on a custom action removes it. A confirmation dialog appears before the action is deleted.
Note: You cannot delete local actions. To customize a local action, use the View action button to create a copy that you can then modify.