0

Fail2ban blocked an IP-address which I would like to undo. I have When I run sudo fail2ban-client set sshd unbanip xxx.xxx.xxx.xxx (where the xx-part is the IP-address) I get a response:

NOK: ('xxx.xxx.xxx.xxx is not banned',)
xxx.xxx.xxx.xxx is not banned

I have been reading about similar issues here and here, but I am still having issues. When I run iptables-save|grep xxx.xxx.xxx.xxx I can find the rule in iptables blocking the address:

-A ufw-user-input -s xxx.xxx.xxx.xxx/32 -j REJECT --reject-with icmp-port-unreacable.

Now though, when I try sudo iptables -D INPUT -s xxx.xxx.xxx.xxx I get the response:

iptables: Bad rule (does a matching rule exist in that chain?).

I tried adding the /32 part to the ipaddress, i tried ufw-user-input instead of INPUT, but each and every time I get the same error.

Now my question is: what can I do to get rid of the rule? And also, what could be the reason that fail2ban is telling me the address is not banned?

0

The command you give iptables -D INPUT -s xxx.xxx.xxx.xxx is querying the INPUT chain but your rule is stored in the ufw-user-input chain of iptables. If you were to give the command sudo iptables -L you would see all chains and one of them would be ufw-user-input and under that one your offending rule should be placed.

To delete that one you can either do sudo iptables -D ufw-user-input -s xxx.xxx.xxx.xxx or use ufw status, find the corresponding rule and use ufw delete $RULE

1
  • your first suggestion was one I already tried and did not work. Your second suggestion did the trick though! Nov 3 '19 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.