I find the fail by doing
grep 10.20.30.40 /var/log/fail2ban.log
which gives an output like
2021-08-23 10:09:17,394 fail2ban.filter [581]: INFO [ssh] Found 10.20.30.40 - 2021-08-23 10:09:17
2021-08-23 10:09:17,395 fail2ban.filter [581]: INFO [sshd] Found 10.20.30.40 - 2021-08-23 10:09:17
2021-08-23 10:09:20,936 fail2ban.filter [581]: INFO [sshd] Found 10.20.30.40 - 2021-08-23 10:09:20
2021-08-23 10:09:20,940 fail2ban.filter [581]: INFO [ssh] Found 10.20.30.40 - 2021-08-23 10:09:20
2021-08-23 10:09:22,654 fail2ban.filter [581]: INFO [ssh] Found 10.20.30.40 - 2021-08-23 10:09:22
2021-08-23 10:09:22,655 fail2ban.filter [581]: INFO [sshd] Found 10.20.30.40 - 2021-08-23 10:09:22
2021-08-23 10:09:22,917 fail2ban.actions [581]: NOTICE [ssh] Ban 10.20.30.40
2021-08-23 10:09:23,085 fail2ban.filter [581]: INFO [recidive] Found 10.20.30.40 - 2021-08-23 10:09:22
2021-08-23 10:09:23,384 fail2ban.actions [581]: NOTICE [sshd] Ban 10.20.30.40
2021-08-23 10:09:24,084 fail2ban.actions [581]: NOTICE [recidive] Ban 10.20.30.40
2021-08-23 10:09:24,099 fail2ban.filter [581]: INFO [recidive] Found 10.20.30.40 - 2021-08-23 10:09:23
From this I can see that I have to unban the IP from three jails:
fail2ban-client set sshd unbanip 10.20.30.40
fail2ban-client set ssh unbanip 10.20.30.40
fail2ban-client set recidive unbanip 10.20.30.40
ignoreips
value. I've added my two VPN exit points as well as the SPF ranges for Google's network, since the box running fail2ban is a GCP Compute instance. Adding your IP address to thatignoreips
attribute will allow you to run any nefarious command without banning yourself.