Delete all fail2ban bans in Ubuntu Linux

Question

How can I delete all fail2ban bans in Ubuntu? I tried everything but I don't get it.

I just want to delete all bans - but I don't know any IP adresses.

Answer 1

Updated answer

As of version 0.10.0 fail2ban-client features the unban command that can be used in two ways:

unban --all                              unbans all IP addresses (in all
                                         jails and database)
unban <IP> ... <IP>                      unbans <IP> (in all jails and
                                         database)

Moreover, the restart <JAIL>, reload <JAIL> and reload commands now also have the --unban option.

Old Answer

fail2ban uses iptables to block traffic. If you would want to see the IP addresses that are currently blocked, type

iptables -L -n

and look for the various chains named fail2ban-something, where something points to the fail2ban jail (for instance, Chain f2b-sshd refers to the jail sshd). If you only want to remove the block for a single IP address <IP> for a given jail <JAIL>, fail2ban offers its own client:

fail2ban-client set <JAIL> unbanip <IP>

Alternatively you can use line numbers. First, list the iptables rules with line numbers:

iptables -L -n --line-numbers

Next you can use

iptables -D fail2ban-somejail <linenumber> 

to remove a single line from the table. As far as I know there is no option to select a range of line numbers, so I guess you would have to wrap this command in a for loop:

for lin in {200..1}; do
   iptables -D fail2ban-somejail $lin
done

Here I made the number 200 up. Check your own output of the command with --line-numbers and note that the last line (with RETURN) should stay. See @roaima's comment below for the reasoning behind counting down.

Answer 2

The best way to unban all IPs, is to set the bantime to 1 second, then all the IP will be freed right away.

fail2ban-client set JailName bantime 1

After that you can set the proper ban time back.

It's better to let fail2ban to do the unban for you. Don't manually edit iptables yourself.

Answer 3

The latest fail2ban-client (0.10) has a unban -all command. Jails can also be individually "restarted", effectively clearing the bans.

If you have an older version, this trick might work for automatic temporary bans: delete the jail which contains the ban then restart fail2ban so that the (now empty) jail would be recreated.

$ fail2ban-client stop sshd
Jail stopped
$ systemctl restart fail2ban

Answer 4

1. Stopping the service will clean all rules added by fail2ban

   service fail2ban stop
   

2. If you do not have any other iptables rules, you can flush it

   iptables -F
   

Be careful: this will erase any other rules in your iptables.

Answer 5

Save iptable config to file

$ iptables-save > iptables.conf

Edit it with any editor you like Than load config back to iptables

$ iptables-restore < iptables.conf

Do not forget to store configuration inside iptables so it will be picked up on reboot

$ service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

Answer 6

heres a simple oneliner to unban the whole fail2ban jail the proper way:

iptables -L f2b-recidive -n | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -v 0.0.0.0 | xargs -n 1 fail2ban-client set recidive unbanip

NOTE: iptables command takes "f2b-" prefix before the jail name while "fail2ban-client" the real jail name

Answer 7

Because of the way fail2ban works, there are only two possible solutions:

• Make a firewall configuration script that includes fail2ban jails and restart the firewall.
• Remove the firewall rules blocking the IPs that you wish to unban.

Answer 8

This is the script I'm using to unban all IP addresses for a ssh jail (simply replace sshd occourence with the name of jail you need... e.g. mysqld-auth)

#!/bin/bash
j=$(iptables -L f2b-sshd | grep -c 'REJECT')
for ((i=1;i<=j;i++))
do
  fail2ban-client set sshd unbanip $(fail2ban-client status sshd | grep 'Banned IP list:' | cut -c23-)
done

Answer 9

Simplest way to unban all IP addresses from all jails:

1. stop the fail2ban service.
2. delete the fail2ban.sqlite3 database. In my case it's located at /var/lib/fail2ban/.
3. start the fail2ban service: fail2ban will create a new database file from scratch.

Answer 10

Maybe this script could help someone with a version < 0.10.0 like me :

#!/bin/bash

for JAIL in $(fail2ban-client status | grep 'Jail list:' | awk 'BEGIN {FS="\t"} {print $2}' | sed 's/, / /g')
do
  for IP in $(fail2ban-client status ${JAIL} | grep 'Banned IP list:' | awk 'BEGIN {FS="\t"} {print $2}' | sed 's/ /\n/g')
  do
    fail2ban-client set ${JAIL} unbanip ${IP}
  done
done

unset JAIL IP

exit 0

Answer 11

For drops all jails, use this command

fail2ban-client stop