I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly.

I know I can work with IPTables directly: iptables -D fail2ban-ssh <number>

But is there not a way to do it with the fail2ban-client?

In the manuals it states something like: fail2ban-client get ssh actionunban <IP>. But that doesn't work.

Also, I don't want to /etc/init.d/fail2ban restart as that would lose all the bans in the list.

up vote 236 down vote accepted

With Fail2Ban before v0.8.8:

fail2ban-client get YOURJAILNAMEHERE actionunban IPADDRESSHERE

With Fail2Ban v0.8.8 and later:

fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE

The hard part is finding the right jail:

  1. Use iptables -L -n to find the rule name...
  2. ...then use fail2ban-client status to get the actual jail names. The rule name and jail name may not be the same but it should be clear which one is related to which.
  • 2
    If you have the following error 'Invalid Action name', read this answer – Morgan Courbet Aug 28 '14 at 8:04
  • 31
    With recent versions of fail2ban you should be using fail2ban-client set JAIL_NAME unbanip 1.2.3.4. – tftd Jan 29 '15 at 17:45
  • 1
    What is the default jail name? /etc/fail2ban/jail.conf doesn't work for me. – Alex W Jan 25 '16 at 14:33
  • 1
    You can find jail name in fail2ban log if you look for your IP – fred727 Sep 8 '16 at 18:54
  • 6
    sshd was the jail name for me. – agustaf Oct 9 '16 at 6:00

Since v0.8.8 there is the unbanip option (actionunban isn't for this purpose) It can be triggered by the set command, if you look at the list of options, you will see the syntax is. So it will be (by heart, please check):

fail2ban-client set ssh-iptables unbanip IPADDRESSHERE 

more generic:

fail2ban-client set JAILNAMEHERE unbanip IPADDRESSHERE

works for me

  • 3
    The unbanip command was added in version 0.8.8. The best solution if you are running 0.8.8 or later. – Alexander Garden Apr 11 '14 at 16:19
  • 1
    The issue related to this in fail2ban tracker is this: github.com/fail2ban/fail2ban/issues/132 – Aseques Apr 22 '14 at 15:50
  • this is the correct answer for current versions. thank you! – billynoah Jul 6 '14 at 2:27
  • getting "Invalid command (no set action or not yet implemented)" – Tom Feb 1 '16 at 2:30
  • you need to state the correct jailname (for example sshd or sshd-dos, see your fail2ban log) – mirage Feb 13 '17 at 5:53

Example for SSH in interactive mode.

type in bash:

fail2ban-client -i

then in interactive mode type read the status of a jail:

status sshd

you'll get:

Status for the jail: ssh
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 6
|  `- File list:    /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned: 2
   `- Banned IP list:   203.113.167.162

then type in fail2ban interactive mode:

set sshd unbanip 203.113.167.162

you'll get:

203.113.167.162

it means no longer 203.113.167.162 in ban list.

  • 3
    For me the jail name was sshd (Ubuntu 16) – scipilot Nov 16 '17 at 2:55
  • On mine, it says total banned: 6, but the list under banned ip is just empty :( have to trail through logs – William Hilsum Jan 9 at 14:09

The answer of ukoda is wrong:

Call fail2ban-client without parameters and you see a list of possible commands:

get JAIL actionunban ACT             

This gets the unban command for the action ACT for JAIL.

Look into the action parameter of the jail you defined, you probably have an iptables action and maybe some more like sendmail, whois or whatever. so in case your action was iptables it will look like this:

fail2ban-client get JAIL actionunban iptables

and the answer will be:

iptables -D fail2ban-NAME -s IP -j DROP

It will only show you what you would have to write for an unban. There is no unban command itself.

  • 3
    Yeah, that worked for me, to unban from SSH jail iptables -D fail2ban-ssh -s <IP> -j DROP. Thanks ingo! – Deele Mar 15 '13 at 12:02

If 192.168.2.1 is banned

sudo iptables -L

Check which Chain it's banned in e.g.

Chain fail2ban-sasl (1 references)

DROP all -- 192.168.2.1 anywhere

Then:

# to view the proper command for un-banning
sudo fail2ban-client get sasl actionunban
# actual command
iptables -D fail2ban-sasl -s 192.168.2.1 -j DROP

Using fail2ban v.0.8.6:

$ sudo fail2ban-client status # to reveal your JAIL name (mine is ssh)
$ sudo fail2ban-client set ssh delignoreip your_ip_address
$ sudo nano /etc/hosts.deny # delete your ip address
$ sudo fail2ban-client reload
  • This assumes that hosts.deny was the action used.... But it is still more useful than things that try to change the method of unbanning IPs on the older versions by using actionunban... – Gert van den Berg Jul 17 at 10:28

You first need to get the name of the jail. You can get the list (in most cases it will be only ssh jail):

fail2ban-client status

After getting the jail name you can check which IPs are being ignored.

fail2ban-client get ssh ignoreip

If your IP is in ignore list, you can delete it via:

fail2ban-client set ssh delignoreip your_ip_address
vi /etc/hosts.deny

Remove your host entry:

fail2ban-client reload
  • 1
    The ignore list is a list of IPs to never ban. That's totally unrelated to the list of currently banned IPs, which is the list that OP wants to remove an IP from. – jlh Nov 24 '15 at 18:10

unfortunately with version 0.8.2 of fail2ban-client the command:

fail2ban-client get jail actionunban ipaddress

does not run. To solve the problem, best choice is upgrade fail2ban to latest version and use new option:

unbanip

If an IP is in multiple jails this becomes a pain.

one-liner to remove 192.168.1.2 from all jails:

 for jail in $(fail2ban-client status | grep 'Jail list:' | sed 's/.*Jail list://' | sed 's/,//g'); do fail2ban-client set $jail unbanip 192.168.1.2; done

a script to do the same https://gist.github.com/yolabingo/c810db6fe7f8bfcb9eb4f6ffc531e474

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.