https://cybertoolchain.io/tools/fail2ban New releases and features in Fail2ban, tracked by The Cyber Toolchain. en Sat, 15 Aug 2026 15:36:40 GMT https://github.com/fail2ban/fail2ban/releases/tag/1.1.1 https://github.com/fail2ban/fail2ban/releases/tag/1.1.1 Sat, 15 Aug 2026 15:36:40 GMT Fail2ban 1.1.1 adds file-based IP allowlists, a new OpenVPN jail, CSF firewall action, and extended filter modes for exim and sshd. • Extends `ignoreip` with `file:...` (or `file://path/file-with-ip-set`) syntax to load ignored IPs, subnets, DNS/FQDN, or raw strings from an external file; the file is read lazily and reloaded dynamically when it changes. • Adds `filter.d/exim.conf` mode `more` (several rules split out from mode `normal`) and extends mode `aggressive` to catch ACL-dropped failures such as 'ACL: Country is banned'. • Extends `filter.d/sshd.conf` modes `ddos` and `aggressive` with regex for timeout-before-authentication connections. • Adds a new OpenVPN jail (`filter.d/openvpn.conf`). • Adds a new CSF (ConfigServer Firewall) action, comparable to the existing APF action. • Updates `paths-common.conf` to change the default `mysql_log` path (default `logpath` for the `mysqld-auth` jail). • Adds systemd-journal regex support to `filter.d/vsftpd.conf` and `filter.d/lighttpd-auth.conf`. • Implements `FileIPAddrSet` in `ipdns.py` supporting file-based IP sets with lazy load and dynamic reload on file change; comments after `#` or `;` are ignored. • Makes manually added ban attempts inform the observer module, taking the known ban-count of bad IPs into account. • Updates OpenRC init script (`files/fail2ban-openrc.init.in`) to start after `nftables` in addition to `iptables`. • Debian package now installs and enables a systemd-managed `fail2ban.socket` (gh-4220). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fail2ban https://github.com/fail2ban/fail2ban/blob/master/ChangeLog https://github.com/fail2ban/fail2ban/blob/master/ChangeLog Thu, 25 Apr 2024 00:00:00 GMT Fail2ban 1.1.0 adds `fail2ban-client stats` and new jail/filter definitions for MikroTik and Dante. • Adds `status --all` flag to `fail2ban-client` to display status of all configured jails in one invocation • Adds `stats`, `statistic`, and `statistics` subcommands to `fail2ban-client` to output tabular ban statistics • Adds `fail2ban-client status --all stats` to return a Python dictionary of statistics for all jails • Adds `fail2ban-regex` support for loading filter settings via `filter.d/<name>` or `<name>.conf` arguments • Adds new action definition `action.d/mikrotik.conf` for MikroTik RouterOS integration • Adds new filter definitions `filter.d/dante.conf`, `filter.d/nginx-forbidden.conf`, and `filter.d/routeros-auth.conf` • Extends `pf` action in `action.d/pf.conf` with support for the `protocol=all` argument • Adds optional TLS support to `smtp.py` via the `ssl` argument • Sets `allowipv6 = auto` as the new default for improved IPv6 detection Breaking changes: • The minimum supported Python version is raised to 3.5 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fail2ban