How can I delete all fail2ban bans in Ubuntu? I tried everything but I don't get it.

I just want to delete all bans - but I don't know any IP adresses.

  • 1
    The bans are typically done on IP addresses through your firewall, so you should look at the firewall rules. – Julie Pelletier May 28 '16 at 14:45
  • yes i know. but i want to clear all bans without telling a ip adress – Patrick May 28 '16 at 15:14
  • "I tried everything" no you didn't. What did you try? – roaima Aug 1 '20 at 13:22

Updated answer

As of version 0.10.0 fail2ban-client features the unban command that can be used in two ways:

unban --all                              unbans all IP addresses (in all
                                         jails and database)
unban <IP> ... <IP>                      unbans <IP> (in all jails and

Moreover, the restart <JAIL>, reload <JAIL> and reload commands now also have the --unban option.

Old Answer

fail2ban uses iptables to block traffic. If you would want to see the IP addresses that are currently blocked, type

iptables -L -n

and look for the various chains named fail2ban-something, where something points to the fail2ban jail (for instance, Chain f2b-sshd refers to the jail sshd). If you only want to remove the block for a single IP address <IP> for a given jail <JAIL>, fail2ban offers its own client:

fail2ban-client set <JAIL> unbanip <IP>

Alternatively you can use line numbers. First, list the iptables rules with line numbers:

iptables -L -n --line-numbers

Next you can use

iptables -D fail2ban-somejail <linenumber> 

to remove a single line from the table. As far as I know there is no option to select a range of line numbers, so I guess you would have to wrap this command in a for loop:

for lin in {200..1}; do
   iptables -D fail2ban-somejail $lin

Here I made the number 200 up. Check your own output of the command with --line-numbers and note that the last line (with RETURN) should stay. See @roaima's comment below for the reasoning behind counting down.

  • You saved me. Thanks a lot. Please add a full command because I had to figure out that I need fail2ban-client in frond of your command. (Because I am a noob) – sebastian.roibu Dec 7 '19 at 17:11

The best way to unban all IPs, is to set the bantime to 1 second, then all the IP will be freed right away.

fail2ban-client set JailName bantime 1

After that you can set the proper ban time back.

It's better to let fail2ban to do the unban for you. Don't manually edit iptables yourself.

  • 1
    This is the only correct answer here. Fail2ban maintains its own ban database that must be cleared independently. Every answer talking about deleting iptables rules ignores that the moment fail2ban is started back up it will re-add the rules you just deleted back to iptables. Also, not every fail2ban configuration uses iptables to implement bans. – Cliff Armstrong Jan 24 '18 at 10:56
  • 4
    find all jails with fail2ban-client status – Flion Jul 16 '18 at 18:12
  • I just issued this command and am watching the number of IPs in my jail decrease toward zero as fail2ban processes the jail. It does not happen really really fast, but that's OK, there were over five thousand entries in the jail. Good answer! – Eric M Feb 28 '19 at 16:12

The latest fail2ban-client (0.10) has a unban -all command. Jails can also be individually "restarted", effectively clearing the bans.

If you have an older version, this trick might work for automatic temporary bans: delete the jail which contains the ban then restart fail2ban so that the (now empty) jail would be recreated.

$ fail2ban-client stop sshd
Jail stopped
$ systemctl restart fail2ban
  • 1
    -all or —all? Or --all? – Wildcard Oct 17 '19 at 3:22
  1. Stopping the service will clean all rules added by fail2ban

    service fail2ban stop
  2. If you do not have any other iptables rules, you can flush it

    iptables -F

Be careful: this will erase any other rules in your iptables.

  • Just stopping then starting again was sufficient. – NateS Nov 28 '20 at 1:59

Save iptable config to file

$ iptables-save > iptables.conf

Edit it with any editor you like Than load config back to iptables

$ iptables-restore < iptables.conf

Do not forget to store configuration inside iptables so it will be picked up on reboot

$ service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

heres a simple oneliner to unban the whole fail2ban jail the proper way:

iptables -L f2b-recidive -n | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -v | xargs -n 1 fail2ban-client set recidive unbanip

NOTE: iptables command takes "f2b-" prefix before the jail name while "fail2ban-client" the real jail name

  • This is the best answer for fail2ban versions bellow 0.10. You can go further creating an alias in .bashrc like fail2ban-purge with one parameter to purge a whole jail. Just replace recidive word above with $1 and use alias as fail2ban-purge <JAIL_NAME>. – ADDISON74 Feb 23 '19 at 10:54

Because of the way fail2ban works, there are only two possible solutions:

  • Make a firewall configuration script that includes fail2ban jails and restart the firewall.
  • Remove the firewall rules blocking the IPs that you wish to unban.

This is the script I'm using to unban all IP addresses for a ssh jail (simply replace sshd occourence with the name of jail you need... e.g. mysqld-auth)

j=$(iptables -L f2b-sshd | grep -c 'REJECT')
for ((i=1;i<=j;i++))
  fail2ban-client set sshd unbanip $(fail2ban-client status sshd | grep 'Banned IP list:' | cut -c23-)

Maybe this script could help someone with a version < 0.10.0 like me :


for JAIL in $(fail2ban-client status | grep 'Jail list:' | awk 'BEGIN {FS="\t"} {print $2}' | sed 's/, / /g')
  for IP in $(fail2ban-client status ${JAIL} | grep 'Banned IP list:' | awk 'BEGIN {FS="\t"} {print $2}' | sed 's/ /\n/g')
    fail2ban-client set ${JAIL} unbanip ${IP}

unset JAIL IP

exit 0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.