03 / FIELD NOTES

Fail2ban and the CrowdSec bouncer

Check whether Fail2ban is active before you add the CrowdSec firewall bouncer.

Changes configfail2ban crowdsec iptables

Why this way

Pick one ban writer. EnvSH prefers CrowdSec when you are starting fresh; if Fail2ban is already healthy, keep it and skip the bouncer. The remove line stays commented on purpose.

When to use

A host already runs Fail2ban and you are deciding whether to add crowdsec-firewall-bouncer-iptables.

When not to

Do not run both tools writing firewall bans unless you know they will not fight.

Prerequisites

systemd

Steps

Check Fail2ban service state

Read-only

systemctl is-active fail2ban || true

Expect: active, inactive, or a not-found style message. Read-only.

Optional remove line stays commented

May lock you out

# nala remove -y fail2ban

Expect: Copy only if you intend to remove Fail2ban. Uncomment before running.

What it changes

The first line only prints the service state. The remove line stays commented. Both tools insert firewall rules, so run one of them.

{
  "slug": "fail2ban-or-bouncer",
  "risk": "caution",
  "tags": [
    "fail2ban",
    "crowdsec",
    "iptables"
  ],
  "updated": "2026-10-28",
  "pathIndex": null,
  "why": "Pick one ban writer. EnvSH prefers CrowdSec when you are starting fresh; if Fail2ban is already healthy, keep it and skip the bouncer. The remove line stays commented on purpose.",
  "steps": [
    {
      "command": "systemctl is-active fail2ban || true",
      "risk": "safe"
    },
    {
      "command": "# nala remove -y fail2ban",
      "risk": "destructive"
    }
  ]
}