Fail2ban filter - ignoreregex for location - path?

Support Network
1

I use a custom filter and in some cases it get’s triggered by letsencrypt challenges …
Can location (part of a path) used with “ignoreregex” e.g.
ignoreregex = /.well-known/acme-challenge/
and should slashes be escaped?

something like this?

ignoreregex = ^<HOST> -.*"GET /.well-known/acme-challenge.*
2

For this kind of question, LLM can often be a starting point to understanding how things work (but it can sometimes say BS so just use it at starting point to learn basic things). Example here from GPT:

Answer from your post (click):

Yes. If you’re referring to a Fail2Ban filter, ignoreregex is a regular expression that’s matched against the log line, not just the URL path. So you can absolutely match a path such as:

ignoreregex = /.well-known/acme-challenge/

However, there are a couple of things to keep in mind:

  1. The / characters do not need to be escaped in Python regular expressions (which Fail2Ban uses). So this is fine:
ignoreregex = /.well-known/acme-challenge/
  1. The . in .well-known should be escaped if you want to match a literal dot. Otherwise . matches any character:
ignoreregex = /\.well-known/acme-challenge/
  1. Since ignoreregex is applied to the entire log line, you don’t usually need anchors unless you specifically want them. A more robust version might be:
ignoreregex = .*\/\.well-known/acme-challenge/.*

although the leading/trailing .* are often unnecessary because the regex engine searches the line for a match.

Example

If your log line is:

192.0.2.1 - - [14/Jul/2026:10:00:00 +0000] "GET /.well-known/acme-challenge/abc123 HTTP/1.1" 404 153

then this is sufficient:

ignoreregex = /\.well-known/acme-challenge/

Verify it

You can check whether your ignoreregex is working with:

fail2ban-regex /path/to/logfile /etc/fail2ban/filter.d/yourfilter.conf

This will show which lines match failregex and which are excluded by ignoreregex.

If you can share your current failregex and a sample log line that is incorrectly triggering the ban, I can suggest the minimal ignoreregex needed.

//EDIT: note that it is quick explanation from LLM and sometimes it is not accurate, but I think for this simple question it may be good enough to test things carefully (don’t copy paste everything it says without understanding).