How to Unban an IP from Fail2Ban: Step-by-Step Guide

by

Sometimes, it may be necessary to unban an IP from Fail2Ban. Here is a tutorial explaining the procedure to follow.

After a brief review of the logs, you will see which event banned the client’s address.

First, we will list the jails:

fail2ban-client status
Status
|- Number of jails:      6
`- Jail list:   haproxy-http-auth, haproxy-noserv, haproxy-ssl, haproxy-wp-login, haproxy-xmlrpc, sshd

My Haproxy logs showed an SSL attack. To confirm that the client’s address is indeed in this jail, we will check the status of that jail:

fail2ban-client status haproxy-ssl
Status for the jail: haproxy-ssl
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     52
|  `- File list:        /var/log/haproxy.log
`- Actions
   |- Currently banned: 10
   |- Total banned:     17
   `- Banned IP list:   XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX YYY.YYY.YYY.YYY

The client’s IP address that I want to unban is indeed present in this jail. Now, we just need to apply the unbanip argument:

fail2ban-client set haproxy-ssl unbanip YYY.YYY.YYY.YYY

And there you go, our client has been successfully removed from the jail!

Leave a Comment