Troubleshooting

Check banned IPs and unban an address in Fail2ban

See which IP addresses Fail2ban has banned, find out why, unban an address in one command and whitelist it so it does not happen again.

BeginnerLinux server5 min read

Sooner or later Fail2ban bans someone it should not: you after a forgotten password, a colleague, or a monitoring service. This guide shows how to see who is banned, find out which rule caught them, lift the ban in one command, and add the address to a whitelist so it does not happen again.

Before you start

  • A Linux VPS with Fail2ban running. If you have not set it up yet, see Install Fail2ban to block brute-force attacks.
  • A way to get a shell with sudo:
  • If you are the one banned, SSH will hang or time out from your address. Use the browser console in the control panel of your VPS provider's control panel. It reaches the server directly, so Fail2ban's firewall rules do not affect it.
  • You can also connect from a different network, such as a phone hotspot, since the ban is tied to one IP address.
  • The IP address you want to unban. To find your own, visit a "what is my IP" site from the affected computer.

List the active jails

Every ban belongs to a jail, a named rule such as sshd or nginx-http-auth. Start by listing them:

Bash
sudo fail2ban-client status
Status
|- Number of jail:      2
`- Jail list:   nginx-http-auth, sshd

See who is banned

Check one jail at a time:

Bash
sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 3
|  |- Total failed:     412
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 2
   |- Total banned:     57
   `- Banned IP list:   198.51.100.20 203.0.113.10

The Banned IP list line shows every address this jail is blocking right now.

To check whether one address is banned anywhere, loop over the jails:

Bash
for j in $(sudo fail2ban-client status | sed -n 's/.*Jail list:\s*//p' | tr ',' ' '); do
  sudo fail2ban-client status "$j" | grep -q '203.0.113.10' && echo "banned in $j"
done

Find out why it was banned

Fail2ban records every ban in its own log, /var/log/fail2ban.log:

Bash
sudo grep '203.0.113.10' /var/log/fail2ban.log | tail -n 20
2026-11-09 09:41:02,118 fail2ban.filter  [812]: INFO    [sshd] Found 203.0.113.10 - 2026-11-09 09:41:01
2026-11-09 09:41:09,530 fail2ban.actions [812]: NOTICE  [sshd] Ban 203.0.113.10

The Found lines are the individual failures. The Ban line names the jail. To see the original failures, check the service's own log. For SSH:

Bash
sudo journalctl -u ssh -u sshd --since "1 hour ago" | grep 203.0.113.10

On Ubuntu and Debian the SSH unit is ssh; on AlmaLinux and Rocky it is sshd. Giving both names is harmless.

This step matters. If a real person typed a wrong password, unbanning is right. If the log shows hundreds of attempts at usernames like admin and oracle, leave the ban in place.

Unban the address

Remove the ban from one jail:

Bash
sudo fail2ban-client set sshd unbanip 203.0.113.10

Fail2ban prints 1 if it removed the ban and 0 if the address was not banned in that jail.

To remove an address from every jail at once:

Bash
sudo fail2ban-client unban 203.0.113.10

Warning: sudo fail2ban-client unban --all lifts every ban in every jail, including real attackers. Use it only when you know you need a clean slate.

An unban is immediate. You do not need to reload Fail2ban or the firewall.

Stop it happening again with ignoreip

If the address belongs to you or someone you trust, add it to ignoreip. Edit /etc/fail2ban/jail.local (create it if it does not exist):

Bash
sudo nano /etc/fail2ban/jail.local
INI
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.10 198.51.100.0/24

Separate entries with spaces. CIDR ranges work, which helps if your office has several addresses. Then test and reload:

Bash
sudo fail2ban-client -t && sudo fail2ban-client reload

You can also add an address at runtime for a single jail. This does not survive a restart, so use it only as a quick fix:

Bash
sudo fail2ban-client set sshd addignoreip 203.0.113.10

Tip: Do not whitelist a home IP that changes often. When it changes, the old address may belong to someone else. A better long-term answer for SSH is key-based login, which removes password failures entirely. See Set up SSH keys.

Check it works

Confirm the address is gone from the banned list and is now on the ignore list:

Bash
sudo fail2ban-client status sshd | grep 'Banned IP list'
sudo fail2ban-client get sshd ignoreip

Then connect over SSH from that address. It should reach the login prompt straight away.

Troubleshooting

  • Unban returns 0: the address is banned in a different jail, or it is not banned by Fail2ban at all. Search fail2ban.log for the IP to find the jail, or use fail2ban-client unban IP to clear it everywhere.
  • Still blocked after unbanning: another layer is blocking you, such as a manual UFW or firewalld rule, or the recidive jail. Check sudo ufw status or sudo firewall-cmd --list-all, and run fail2ban-client status recidive if that jail exists.
  • The address is banned again within minutes: whatever caused the failures is still running, such as an old saved password in an SFTP client or a script. Fix the client, then unban.
  • fail2ban-client says it cannot connect to the server: Fail2ban is not running. Start it with sudo systemctl start fail2ban and check sudo systemctl status fail2ban for errors.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides

Troubleshooting

Fix common Composer errors on a server

Solve frequent Composer problems: memory exhausted, PHP version or extension requirements, dependency conflicts, lock file mismatches, authentication and running as root.

3 min read