fail2ban vs Cloudflare for Brute-Force Protection

fail2ban and Cloudflare both stop brute-force attacks, but they work at different layers, and framing them as competitors is a mistake. fail2ban lives on your server and bans IPs that fail repeatedly at services like SSH. Cloudflare lives at the network edge and absorbs abusive traffic before it ever touches your box. The honest answer for a self-hosted setup is to run both: Cloudflare for the web layer that faces the whole internet, fail2ban for the SSH and application layer that Cloudflare cannot see. Here is how to think about which does what.

What fail2ban actually does

fail2ban watches log files. It reads your auth log, your web server log, whatever you point it at, and when it sees a pattern of failures from one IP, it adds a temporary firewall ban. Ten failed SSH logins in a minute? Banned for an hour. It is simple, it runs entirely on your machine, and it needs no third party.

Its strength is that it protects things Cloudflare never sees. SSH is the big one. Your SSH port is on the server, not behind a web proxy, so an edge network in front of your website does nothing for it. fail2ban is the tool that watches SSH and bans the scanners hammering it. It also works on any service that logs failures, which makes it a general-purpose local defense. It pairs naturally with a proper SSH hardening checklist, where it is the layer that trims the brute-force noise after you have turned off password auth.

Its weakness is that the traffic still reaches your box. fail2ban bans an IP after the failures arrive, so your server still spends resources receiving and logging the attack. Against a distributed attack from thousands of IPs, banning them one at a time is a losing game.

What Cloudflare actually does

Cloudflare sits in front of your web traffic. Requests hit their network first, and only clean traffic is forwarded to your origin. That means abusive web traffic, credential-stuffing against your login form, volumetric floods, bot swarms, gets absorbed at the edge, at a scale no single VPS could survive.

Its strength is capacity and reach. Cloudflare handles distributed attacks that would flatten your box, applies rate limiting and bot rules across millions of requests, and hides your origin IP so attackers cannot bypass it and hit your server directly. Putting Cloudflare in front of your own server is one of the highest-leverage moves in self-hosting for exactly this reason.

Its weakness is scope. Cloudflare protects what flows through it, which is your web traffic. It does not protect SSH, it does not protect a database port, and it does not protect any service you connect to directly rather than through the web proxy. If an attacker learns your origin IP, they can try to go around Cloudflare entirely, which is why keeping that IP hidden and the firewall tight still matters.

Why you run both

The two tools cover each other's blind spots. Think in layers.

• Cloudflare handles the web layer: the login forms, the APIs, the public site that the entire internet can reach. It absorbs volume and bots at the edge.
• fail2ban handles the server layer: SSH and any local service, banning the scanners that come straight at your IP.
• The firewall underneath handles ports: only what you serve is open, covered in configuring UFW on a VPS.

Each layer catches what the others miss. Cloudflare cannot see your SSH attempts. fail2ban cannot absorb a distributed web flood. The firewall cannot tell a legitimate login from a malicious one. Together they form a real defense, and none of them is redundant.

Which to reach for first

If you only have time for one thing right now, it depends on what is exposed.

• If your public risk is a website or API getting hammered, Cloudflare first. It solves the volume problem no local tool can.
• If your public risk is SSH getting brute-forced, fail2ban plus key-only auth first. That closes the front door.

But this is a false choice in practice, because both are cheap. Cloudflare's protective layer is free for most small sites, and fail2ban is a package you install in minutes. There is no real cost tradeoff that justifies picking one and skipping the other.

I run Cloudflare in front of every public app and fail2ban on every box, all hosted through HostSSH. The edge network eats the web-scale abuse, the local ban tool handles the direct scanners, and the firewall keeps the surface small. They are not competitors. They are two layers of the same wall, and self-hosting well means building all of it.