Ubuntu 26.04 LTS – fail2ban bans trusted subnet due to aggressive jail policy

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators observe: Ubuntu 26.04 LTS – fail2ban bans trusted subnet due to aggressive jail policy. Legitimate admin access is denied.

Environment & Reproduction

Issue appears when ignoreip is incomplete and retry windows are too strict.

# Baseline context
lsb_release -a
systemctl status fail2ban --no-pager
sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo journalctl -u fail2ban -n 120 --no-pager

Root Cause Analysis

Trusted network ranges are not excluded, causing repeated auth noise to trigger bans.

Quick Triage

List active bans and confirm source subnet involvement.

# Quick triage
sudo fail2ban-client status sshd
sudo iptables -S | grep -i f2b || true
sudo nft list ruleset | grep -i f2b || true

Step-by-Step Diagnosis

Review jail configuration hierarchy and recent ban events.

# Detailed diagnosis
sudo grep -R 'ignoreip|maxretry|findtime|bantime' /etc/fail2ban/jail.conf /etc/fail2ban/jail.d /etc/fail2ban/jail.local 2>/dev/null
sudo zgrep -h 'Ban ' /var/log/fail2ban.log* | tail -n 120

Solution – Primary Fix

Add trusted subnet to ignoreip and tune retry policy for SSH jail.

# Primary fix
sudo tee /etc/fail2ban/jail.d/sshd-local.conf >/dev/null <<'EOF'
[sshd]
ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8
maxretry = 6
findtime = 10m
bantime = 30m
EOF
sudo systemctl restart fail2ban
sudo fail2ban-client set sshd unbanip 10.0.0.0/8

Solution – Alternative Approaches

Use firewall allowlists in UFW plus less aggressive fail2ban scope.

# Alternative
sudo ufw allow from 10.0.0.0/8 to any port 22 proto tcp
sudo systemctl restart fail2ban

Verification & Acceptance Criteria

Trusted subnet remains unbanned while brute-force attempts are still blocked.

# Verify
sudo fail2ban-client status sshd
sudo journalctl -u fail2ban -n 80 --no-pager
sudo ufw status verbose

Rollback Plan

Revert custom jail override if policy becomes too permissive.

# Rollback
sudo rm -f /etc/fail2ban/jail.d/sshd-local.conf
sudo systemctl restart fail2ban

Prevention & Hardening

Maintain explicit trusted ranges and monitor ban trends continuously.

# Hardening
sudo fail2ban-client status
sudo journalctl -u fail2ban --since '24 hours ago' --no-pager | grep -E 'Ban|Unban' | tail -n 120

Related Errors & Cross-Refs

Related patterns include lockout after MFA retries and false positives from internal scanners.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Fail2ban jail configuration docs and Ubuntu SSH hardening guidance.