0

Fail2ban blocked an IP-address which I would like to undo. I have When I run sudo fail2ban-client set sshd unbanip xxx.xxx.xxx.xxx (where the xx-part is the IP-address) I get a response:

NOK: ('xxx.xxx.xxx.xxx is not banned',)
xxx.xxx.xxx.xxx is not banned

I have been reading about similar issues here and here, but I am still having issues. When I run iptables-save|grep xxx.xxx.xxx.xxx I can find the rule in iptables blocking the address:

-A ufw-user-input -s xxx.xxx.xxx.xxx/32 -j REJECT --reject-with icmp-port-unreacable.

Now though, when I try sudo iptables -D INPUT -s xxx.xxx.xxx.xxx I get the response:

iptables: Bad rule (does a matching rule exist in that chain?).

I tried adding the /32 part to the ipaddress, i tried ufw-user-input instead of INPUT, but each and every time I get the same error.

Now my question is: what can I do to get rid of the rule? And also, what could be the reason that fail2ban is telling me the address is not banned?

1 Answer 1

0

The command you give iptables -D INPUT -s xxx.xxx.xxx.xxx is querying the INPUT chain but your rule is stored in the ufw-user-input chain of iptables. If you were to give the command sudo iptables -L you would see all chains and one of them would be ufw-user-input and under that one your offending rule should be placed.

To delete that one you can either do sudo iptables -D ufw-user-input -s xxx.xxx.xxx.xxx or use ufw status, find the corresponding rule and use ufw delete $RULE

1
  • your first suggestion was one I already tried and did not work. Your second suggestion did the trick though! Nov 3, 2019 at 20:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .