How can I delete all fail2ban bans in Ubuntu? I tried everything but I don't get it.

I just want to delete all bans - but I don't know any IP adresses.

  • 1
    The bans are typically done on IP addresses through your firewall, so you should look at the firewall rules. Commented May 28, 2016 at 14:45
  • yes i know. but i want to clear all bans without telling a ip adress
    – Patrick
    Commented May 28, 2016 at 15:14
  • "I tried everything" no you didn't. What did you try? Commented Aug 1, 2020 at 13:22

11 Answers 11


Updated answer

As of version 0.10.0 fail2ban-client features the unban command that can be used in two ways:

unban --all                              unbans all IP addresses (in all
                                         jails and database)
unban <IP> ... <IP>                      unbans <IP> (in all jails and

Moreover, the restart <JAIL>, reload <JAIL> and reload commands now also have the --unban option.

Old Answer

fail2ban uses iptables to block traffic. If you would want to see the IP addresses that are currently blocked, type

iptables -L -n

and look for the various chains named fail2ban-something, where something points to the fail2ban jail (for instance, Chain f2b-sshd refers to the jail sshd). If you only want to remove the block for a single IP address <IP> for a given jail <JAIL>, fail2ban offers its own client:

fail2ban-client set <JAIL> unbanip <IP>

Alternatively you can use line numbers. First, list the iptables rules with line numbers:

iptables -L -n --line-numbers

Next you can use

iptables -D fail2ban-somejail <linenumber> 

to remove a single line from the table. As far as I know there is no option to select a range of line numbers, so I guess you would have to wrap this command in a for loop:

for lin in {200..1}; do
   iptables -D fail2ban-somejail $lin

Here I made the number 200 up. Check your own output of the command with --line-numbers and note that the last line (with RETURN) should stay. See @roaima's comment below for the reasoning behind counting down.

  • 1
    You saved me. Thanks a lot. Please add a full command because I had to figure out that I need fail2ban-client in frond of your command. (Because I am a noob) Commented Dec 7, 2019 at 17:11

The best way to unban all IPs, is to set the bantime to 1 second, then all the IP will be freed right away.

fail2ban-client set JailName bantime 1

After that you can set the proper ban time back.

It's better to let fail2ban to do the unban for you. Don't manually edit iptables yourself.

  • 1
    This is the only correct answer here. Fail2ban maintains its own ban database that must be cleared independently. Every answer talking about deleting iptables rules ignores that the moment fail2ban is started back up it will re-add the rules you just deleted back to iptables. Also, not every fail2ban configuration uses iptables to implement bans. Commented Jan 24, 2018 at 10:56
  • 6
    find all jails with fail2ban-client status
    – Flion
    Commented Jul 16, 2018 at 18:12
  • I just issued this command and am watching the number of IPs in my jail decrease toward zero as fail2ban processes the jail. It does not happen really really fast, but that's OK, there were over five thousand entries in the jail. Good answer!
    – anon
    Commented Feb 28, 2019 at 16:12

The latest fail2ban-client (0.10) has a unban -all command. Jails can also be individually "restarted", effectively clearing the bans.

If you have an older version, this trick might work for automatic temporary bans: delete the jail which contains the ban then restart fail2ban so that the (now empty) jail would be recreated.

$ fail2ban-client stop sshd
Jail stopped
$ systemctl restart fail2ban
  • 1
    -all or —all? Or --all?
    – Wildcard
    Commented Oct 17, 2019 at 3:22
  1. Stopping the service will clean all rules added by fail2ban

    service fail2ban stop
  2. If you do not have any other iptables rules, you can flush it

    iptables -F

Be careful: this will erase any other rules in your iptables.

  • Just stopping then starting again was sufficient.
    – NateS
    Commented Nov 28, 2020 at 1:59

Save iptable config to file

$ iptables-save > iptables.conf

Edit it with any editor you like Than load config back to iptables

$ iptables-restore < iptables.conf

Do not forget to store configuration inside iptables so it will be picked up on reboot

$ service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

heres a simple oneliner to unban the whole fail2ban jail the proper way:

iptables -L f2b-recidive -n | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -v | xargs -n 1 fail2ban-client set recidive unbanip

NOTE: iptables command takes "f2b-" prefix before the jail name while "fail2ban-client" the real jail name

  • This is the best answer for fail2ban versions bellow 0.10. You can go further creating an alias in .bashrc like fail2ban-purge with one parameter to purge a whole jail. Just replace recidive word above with $1 and use alias as fail2ban-purge <JAIL_NAME>.
    – ADDISON74
    Commented Feb 23, 2019 at 10:54

Because of the way fail2ban works, there are only two possible solutions:

  • Make a firewall configuration script that includes fail2ban jails and restart the firewall.
  • Remove the firewall rules blocking the IPs that you wish to unban.

This is the script I'm using to unban all IP addresses for a ssh jail (simply replace sshd occourence with the name of jail you need... e.g. mysqld-auth)

j=$(iptables -L f2b-sshd | grep -c 'REJECT')
for ((i=1;i<=j;i++))
  fail2ban-client set sshd unbanip $(fail2ban-client status sshd | grep 'Banned IP list:' | cut -c23-)

Simplest way to unban all IP addresses from all jails:

  1. stop the fail2ban service.
  2. delete the fail2ban.sqlite3 database. In my case it's located at /var/lib/fail2ban/.
  3. start the fail2ban service: fail2ban will create a new database file from scratch.
  • This should be the accepted answer imho. It performs the desired task flawlessly. I would, however, delete log file too, as I think fai2ban pulls from that too.
    – oemb1905
    Commented Jun 1, 2023 at 17:29

Maybe this script could help someone with a version < 0.10.0 like me :


for JAIL in $(fail2ban-client status | grep 'Jail list:' | awk 'BEGIN {FS="\t"} {print $2}' | sed 's/, / /g')
  for IP in $(fail2ban-client status ${JAIL} | grep 'Banned IP list:' | awk 'BEGIN {FS="\t"} {print $2}' | sed 's/ /\n/g')
    fail2ban-client set ${JAIL} unbanip ${IP}

unset JAIL IP

exit 0

For drops all jails, use this command

fail2ban-client stop
  • 1
    This also stops the fail2ban server. Commented Jan 25, 2022 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .