Fail2Ban - unblocking an IP address

Got an IP address blocked by Fail2Ban? See how to easily unblock it! A practical guide will show you the iptables commands to quickly remove a ban.

We can remove bans in two ways. The first is simply restarting the fail2ban process, in which case all blocks will be removed. Since version 0.8.6, blocks are still kept after the program restarts. The second method removes a ban for a specific IP address using iptables, of course provided we chose iptables as the blocking method.

  • The first step is displaying the content of all rules with the command: iptables -nL
    • Chain INPUT (policy DROP)
target     prot opt source               destination
fail2ban-default  all  --  0.0.0.0/0     0.0.0.0/0
DROP       all  --  223.25.195.163       0.0.0.0/0
DROP       all  --  202.72.179.219       0.0.0.0/0
...
...
...
Chain fail2ban-default (1 references)
target     prot opt source               destination
DROP       all  --  58.83.157.6          0.0.0.0/0
DROP       all  --  94.56.48.130         0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain fail2ban-postfix (1 references)
target     prot opt source               destination
DROP       all  --  14.63.214.64         0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain fail2ban-sasl (1 references)
target     prot opt source               destination
DROP       all  --  221.139.14.120       0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain fail2ban-ssh (1 references)
target     prot opt source               destination
DROP       all  --  87.106.227.246       0.0.0.0/0
DROP       all  --  217.126.193.74       0.0.0.0/0
DROP       all  --  220.164.144.135      0.0.0.0/0
DROP       all  --  67.137.122.86        0.0.0.0/0
DROP       all  --  50.116.61.79         0.0.0.0/0
DROP       all  --  121.196.45.14         0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0
  • We're interested in the fail2ban-<service_name> chains, because we'll need their name to unblock an IP address. For example, to unban ssh for the IP address 220.164.144.135, as root (ubuntu sudo) we issue the command:
    iptables -D fail2ban-ssh -s 220.164.144.135 -j DROP. Similarly, unblocking the mail server for the IP address 14.63.214.64 would look like this: iptables -D fail2ban-postfix -s 14.63.214.64 -j DROP.
  • To avoid a mistake while retyping the IP address, we can number the blocked entries by issuing the command: iptables -nL fail2ban-ssh --line-numbers.
    • Chain fail2ban-ssh (1 references)
num  target     prot opt source               destination
1    DROP       all  --  87.106.227.246       0.0.0.0/0
2    DROP       all  --  217.126.193.74       0.0.0.0/0
3    DROP       all  --  220.164.144.135      0.0.0.0/0
4    DROP       all  --  67.137.122.86        0.0.0.0/0
5    DROP       all  --  50.116.61.79         0.0.0.0/0
6    DROP       all  --  121.196.45.14        0.0.0.0/0
7    RETURN     all  --  0.0.0.0/0            0.0.0.0/0
  • Having such a listing, we base ourselves on the chain name and the number: iptables -D fail2ban-ssh 4. This way we've removed the ssh block for IP: 67.137.122.86