swissmakers/fail2ban-ui

A Go-based, management interface for Fail2Ban. It provides an intuitive dashboard to monitor, configure, and manage Fail2Ban instances in real time, supporting both local and remote Fail2ban servers. Built by Swissmakers.

Summary

Fail2Ban UI is a Go-based web dashboard for managing Fail2Ban installations on one or more Linux hosts from a single place. It does not replace the Fail2Ban daemon, which still makes all ban decisions; instead it connects to existing instances and adds a UI for searching IPs, managing jails and filters, and visualizing ban activity. The project is released under AGPL-3.0 and is maintained by Swissmakers GmbH.

What it is useful for

Engineers running Fail2Ban on multiple hosts typically have to SSH into each box to read jail status, find a banned IP, or edit a filter. Fail2Ban UI centralizes that work into a browser session and connects to each host through one of three connectors:

• Local for Fail2Ban running on the same host as the UI (uses the Fail2Ban Unix socket and local files).
• SSH for remote hosts without installing an agent, using key-based SSH and a dedicated service account with minimal sudo rules.
• Agent for environments where SSH from the UI host is not desired, using a small HTTP agent on the managed host.

Beyond status and unban, the UI adds capabilities that are awkward to do by hand: editing jail and filter configurations remotely, testing log paths and filter regex patterns against real log lines, a Kibana-like activity timeline that supports zooming into time ranges, comparing two incidents to isolate repeat attackers, and exporting IP lists as CSV or JSON. It also handles permanent blocking on MikroTik, pfSense, OPNsense, and UniFi, and ships alerts over Email (SMTP), Webhook, and Elasticsearch with GeoIP/Whois enrichment. Optional OIDC login is supported with Keycloak, Authentik, or Pocket-ID.

How engineers can use it

The documented quick start uses Podman on a Linux host that already runs Fail2Ban:

podman run -d --name fail2ban-ui --network=host \
  -v /opt/fail2ban-ui:/config:Z \
  -v /etc/fail2ban:/etc/fail2ban:Z \
  -v /var/run/fail2ban:/var/run/fail2ban \
  -v /var/log:/var/log:ro \
  swissmakers/fail2ban-ui:latest

After the container starts, open http://localhost:8080, go to Settings -> Manage Servers, enable the local connector, and click Test connection. For Docker Compose, systemd, the SSH and agent connectors, OIDC setup, and reverse-proxy configuration, the README links to dedicated docs in docs/ and deployment/.

Documented limitations worth noting: the UI should not be exposed directly to the public Internet, and is intended to sit behind a reverse proxy, VPN, or firewall. Remote jail and filter management depends on the chosen connector's capabilities, and the SSH connector requires a service account whose sudo access is limited to fail2ban-client and systemctl restart fail2ban. Container setups on SELinux hosts may need the nis_enabled boolean for callbacks, and per-path log access can show a yellow "cannot verify" state when the SSH user cannot read a directory. These caveats, plus agent and OIDC setup, are covered in docs/security.md and the connector-specific docs.