Here are all of the primary regex symbols and special tokens used to build Fail2ban match patterns:

Anchors & Position Indicators

• ^: Matches the beginning of a line.
• $: Matches the end of a line.
• \b: Matches a word boundary (the transition between a word character and a space/punctuation). [1]

Quantifiers (How Many Times)

• *: Matches zero or more times of the preceding character.
• +: Matches one or more times of the preceding character.
• ?: Matches zero or one time (makes the preceding character optional, or makes quantifiers non-greedy).
• {n}: Matches exactly n times.
• {n,}: Matches n or more times.
• {n,m}: Matches between n and m times. [1, 2]

Character Classes (What to Match)

• .: Matches any single character except a newline.
• \d: Matches any digit (0-9).
• \D: Matches any non-digit.
• \s: Matches any whitespace character (spaces, tabs).
• \S: Matches any non-whitespace character.
• \w: Matches any alphanumeric character plus underscore (letters, numbers, _).
• \W: Matches any non-alphanumeric character.
• [...]: Matches any single character contained within the brackets (e.g., [a-z] for lowercase letters).
• [^...]: Matches any single character NOT contained within the brackets.

Groups & Logic

• |: Acts as an OR operator (e.g., error|fail matches "error" or "fail").
• (...): Groups characters together to apply quantifiers or isolate logical sections.
• \: The escape character, used to treat a regex symbol as literal text (e.g., \. matches a literal period instead of "any character").

Fail2ban Special Tags

Fail2ban introduces its own custom shortcut tags that sit alongside regular regex symbols:

• <HOST>: The most critical tag; it matches and captures any IPv4 or IPv6 address.
• <ADDR>: Matches an IP address or a socket path.
• <CIDR>: Matches an IP block using CIDR notation (e.g., /24).
• %(__prefix_line)s: A built-in macro that automatically matches standard system daemon log prefixes (like timestamps, hostnames, and process IDs).