Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly.

I know I can work with IPTables directly: iptables -D fail2ban-ssh <number>

But is there not a way to do it with the fail2ban-client?

In the manuals it states something like: fail2ban-client get ssh actionunban <IP>. But that doesn't work.

Also, I don't want to /etc/init.d/fail2ban restart as that would lose all the bans in the list.

share|improve this question
    
iptables -D fail2ban-ssh <number> is what you should stick with. It works everytime, whereas different versions of the fail2ban client have a different set of working commands. –  sjas Nov 6 at 11:42

6 Answers 6

up vote 8 down vote accepted

The command fail2ban-client get jail actionunban ipaddress will do the job. The hard part is finding the right jail.

Use iptables -L -n to find the rule name then use fail2ban-client status to get the actual jail names. The rule name and jail name may not be the same but it should be clear which one is related to which.

share|improve this answer
    
If you have the following error 'Invalid Action name', read this answer –  Morgan Courbet Aug 28 at 8:04

Since 0.8.8 there is the unbanip option (actionunban isn't for this purpose) It can be triggered by the set command, if you look at the list of options, you will see the syntaxis. So it will be (by heart, please check):

fail2ban-client set ssh-iptables unbanip m.y.i.p 

more generic:

fail2ban-client set JAIL unbanip MYIP

works for me

share|improve this answer
2  
The unbanip command was added in version 0.8.8. The best solution if you are running 0.8.8 or later. –  Alexander Garden Apr 11 at 16:19
    
The issue related to this in fail2ban tracker is this: github.com/fail2ban/fail2ban/issues/132 –  Aseques Apr 22 at 15:50
    
this is the correct answer for current versions. thank you! –  billynoah Jul 6 at 2:27

the answer from ukoda is wrong:

call fail2ban-client without parameters and you see a list of possible commands:

get JAIL actionunban ACT
gets the unban command for the action ACT for JAIL

look into the action parameter of the jail you defined, you probably have an iptables action and maybe some more like sendmail-whois or whatever. so in case your action was iptables it will look like this:

fail2ban-client get JAIL actionunban iptables

and the answer will be: iptables -D fail2ban-NAME -s IP -j DROP

it will only show you what you would have to write for an unban. there is no unban command.

share|improve this answer
    
Yeah, that worked for me, to unban from SSH jail iptables -D fail2ban-ssh -s <IP> -j DROP. Thanks ingo! –  Deele Mar 15 '13 at 12:02

Using fail2ban v.0.8.6:

$ sudo fail2ban-client status # to reveal your JAIL name (mine is ssh)
$ sudo fail2ban-client set ssh delignoreip your_ip_address
$ sudo nano /etc/hosts.deny # delete your ip address
$ sudo fail2ban-client reload
share|improve this answer

unfortunately with version 0.8.2 of fail2ban-client the command:

fail2ban-client get jail actionunban ipaddress

does not run. To solve the problem, best choice is upgrade fail2ban to latest version and use new option:

unbanip
share|improve this answer

If 192.168.2.1 is banned

sudo iptables -L

Check which Chain it's banned in e.g.

Chain fail2ban-sasl (1 references)

DROP all -- 192.168.2.1 anywhere

Then:

# to view the proper command for un-banning
sudo fail2ban-client get sasl actionunban
# actual command
iptables -D fail2ban-sasl -s 192.168.2.1 -j DROP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.