Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just installed Fail2Ban.

I want to add my ISP IP to my ignore list but my IP is dynamic.

In the jail.conf file, I have like this:


# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip =
bantime  = 600
maxretry = 3

My DNS look something like this:

Is it possible to add DNS wild to the ignore list? eg, *

share|improve this question
I don't see why you would need to do this. Connections within your computer will have a source address of Make sure you aren't banning the destination address. – BillThor Mar 10 '12 at 18:32
up vote 5 down vote accepted

fail2ban don't allow you to use wildcard addresses.
You have several possibilities :
1. use a dynamic DNS for the address you want to exclude
2. write an accept rule for iptable, executed prior to fail2ban rules
3. just configure fail2ban

How to configure fail2ban to ignore your address ?
Inside /etc/fail2ban/filter.d/ you have pre-made filters. Your rule(s) already use one of them (for example with filter = sshd use the sshd filter).
Just modify the filter(s) you want (or modify a copy) to add an "exclude" rule.
The exclude rules start with ignoreregex. They are written exactly as the "match" rules. Have a look at man fail2ban-regex.
For your example you can just add ignoreregex in the desired filter.
But this will also protect any attacker from the same ISP.

share|improve this answer
In contrast to the OP's jail.config, mine says ignoreip = <-- Do you know what that / (slash) is there for? Is it perhaps a range between 1–8, no? If so, maybe it's possible to enter the first static numbers and put the dynamic numbers between 1/255 … I may be totally out in the blue here, though. :) – Henrik Apr 22 '12 at 20:04
/8 means the number of bits set to 1 in the netmask. So /8 means and /24 mean – Gregory MOUSSAT Apr 22 '12 at 21:14

create a simple script in /usr/local/bin/userip

if [ ! -z $1 ]; then
    who --ips | grep ^$1 | rev | cut -d' ' -f1 | rev | tail -n1

That Get ip address of logged username passed in first argument

Edit /etc/fail2ban/action.d/iptables-multiport.conf (or iptables.conf)

actionban = [ ''$(userip YOURUSER) != '<ip>' ] && iptables -I fail2ban-<name> 1 -s <ip> -j DROP

now fail2ban not block your ip address until you are logged with your username YOURUSER with ssh

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.