Fuse Fail2ban With Firewalld

• 18 Jul 2026
• One-minute read

A note on merging fail2ban with firewalld on Debian, so all bans are applied through firewalld.

By default, Debian fail2ban updates the nftables (or iptables) directly, independent of firewalld. In other words, firewalld and fail2ban are unaware of one another, and both tools manage your firewall state.

If you prefer firewalld to manage the active firewall, and have fail2Ban request dynamic bans through it, similar to how it's an easily installed option in Fedora, here is how to combine the two.

Default Debian fail2ban rules are in /etc/fail2ban/jail.d/defaults-debian.conf

We need to override these. Create a new file in /etc/fail2ban/jail.d/defaults.debian.local with our new defaults:

  [DEFAULT]
  banaction = firewallcmd-ipset
  banaction_allports = firewallcmd-ipset

Aside; you can read about the .local naming convention here:

  man 5 jail.conf

Then, restart both firewalld and fail2ban.

You can see the output with:

  firewall-cmd --direct --get-all-rules

Let one of your jails be 'your-awesome-jail', then the output of these three should show the same banned IP addresses:

  fail2ban-client status your-awesome-jail | grep "Banned IP list" | sed 's/.*Banned IP list:\s*//' | tr ' ' '\n' | sort
  ipset list f2b-your-awesome-jail | awk '/Members:/ {flag=1; next} /^$/ {flag=0} flag' | sort
  ipset list f2b-your-awesome-jail6 | awk '/Members:/ {flag=1; next} /^$/ {flag=0} flag' | sort