#4215·fail2ban

[RFE]: Dynamic value for maxretry

Author: DavidAnderson684Created Aug 13, 2026Updated Aug 18, 2026
Labelsenhancement

I have searched for similar issues. The issue https://github.com/fail2ban/fail2ban/issues/4009 has a brief suggestion of introducing an option maxretry.formula, but that is not discussed and my use case is not covered. My end goal is similar to the end goal of https://github.com/fail2ban/fail2ban/issues/927 , but I am suggesting something substantially different.

Feature request type

  1. Make "maxretry" to be a dynamic value.
  2. Within the variables permitted to be used within that dynamic value, include a lookup of banned IPs in a specified subnet.

Description

Often, when an IP is banned, a nearby IP then resumes the attack. A.B.C.D is banned; then A.B.C.D+1 starts attacking. Issue #927 wants to ban subnets. I don't want to do that. I want to only ban IPs that actually register bad behaviour. But, I want the threshold for banning IPs that register bad behaviour to be lowered, if a "nearby" IP has already been banned.

i.e. for example (translated into English)

maxretry = "5, or 2 if something in the same /28 is already in the ban list"

The 5, 2 and 28 would be values chosen by the system administrator.

Considered alternatives

There are already feature requests for blocking whole subnets, or aggregating whole subnets to be considered as a single entity. The former has significant differences. The latter is similar, but I do not wish to ban any individual IP address before it exhibits bad behaviour. Moreover, discussion in Github issues indicates that those other two solutions will be complex to implement, whereas it seems possible to me that the proposed solution may be much simpler to achieve.