IPBan (DigitalRuby/IPBan) is the most widely used free tool for banning brute-forcing IPs on Windows, and it also runs on Linux. If you are comparing it with KIPBan, the short version is: both read failed logons and block the IP in the local firewall, but they are built for different jobs. Below is what each does, based on the IPBan project's own README.
What IPBan does
- Free and open source. MIT license, developed since 2011.
- Windows and Linux. Windows 10 and Windows Server 2016 or newer; on Linux it needs firewalld, nftables or iptables.
- Detection. Failed logons from the Windows event log and from log files. By default it watches SSH on Linux and RDP, OpenSSH, VNC, MySQL, SQL Server, Exchange, SmarterMail and MailEnable on Windows.
- Blocking through the local firewall, configured in
ipban.config(thresholds, ban duration, polling). - Global database. Optional anonymous submission of banned IPs to a shared database; a paid IPBan Pro edition exists with extra features.
Where a different approach helps
- One config per server. IPBan is configured and updated on each machine. With a dozen servers you maintain the config, whitelist and version in a dozen places.
- No fleet view. There is no dashboard that shows which server banned which IP, with groups, tags and one whitelist.
- Your own servers don't share bans by default. An IP caught on server A reaches server B only through the global database, not as a private list of your own fleet.
What KIPBan adds
- A private shared ban list across your Windows and Linux servers: an IP caught on one is blocked on all within 5 minutes.
- A central dashboard with groups, a whitelist for the whole fleet, ban history, Telegram notifications and agent updates in one click.
- An escalating ban ladder: 3 days, 30 days, then forever (configurable).
- On Linux it works on top of your existing fail2ban jails instead of replacing them.
- A block list for routers and nginx.
- The Windows agent is built from source on your server, with no downloaded binaries.
Which to choose
Take IPBan if you have one or two machines and want a free local tool with no account. Take KIPBan if you run a fleet, want a single dashboard and want a ban on one server to protect the rest. They solve the same local problem, so run one of them per server, not both. The first two KIPBan servers are free, so you can compare them on real traffic.
Background on the whole category is in Fail2ban for Windows; for Linux fleets see fail2ban on multiple servers.
Questions about IPBan and KIPBan
Is IPBan free?
Yes, the open-source edition is MIT-licensed. A paid IPBan Pro edition also exists; see the IPBan website for its current features and price.
Can KIPBan replace IPBan?
On Windows, yes: both read failed logons and block IPs in Windows Firewall. Remove IPBan before installing the KIPBan agent so the two don't maintain overlapping rules.
Does IPBan work on Linux?
Yes, with firewalld, nftables or iptables. KIPBan on Linux takes a different route: it hooks into your fail2ban jails.