15

How can I delete all fail2ban bans in Ubuntu? I tried everything but I don't get it.

I just want to delete all bans - but I don't know any IP adresses.

  • 1
    The bans are typically done on IP addresses through your firewall, so you should look at the firewall rules. – Julie Pelletier May 28 '16 at 14:45
  • yes i know. but i want to clear all bans without telling a ip adress – Patrick May 28 '16 at 15:14
21

Updated answer

As of version 0.10.0 fail2ban-client features the unban command that can be used in two ways:

unban --all                              unbans all IP addresses (in all
                                         jails and database)
unban <IP> ... <IP>                      unbans <IP> (in all jails and
                                         database)

Moreover, the restart <JAIL>, reload <JAIL> and reload commands now also have the --unban option.

Old Answer

fail2ban uses iptables to block traffic. If you would want to see the IP addresses that are currently blocked, type

iptables -L -n

and look for the various chains named fail2ban-something, where something points to the fail2ban jail (for instance, Chain f2b-sshd refers to the jail sshd). If you only want to remove the block for a single IP address <IP> for a given jail <JAIL>, fail2ban offers its own client:

fail2ban-client set <JAIL> unbanip <IP>

Alternatively you can use line numbers. First, list the iptables rules with line numbers:

iptables -L -n --line-numbers

Next you can use

iptables -D fail2ban-somejail <linenumber> 

to remove a single line from the table. As far as I know there is no option to select a range of line numbers, so I guess you would have to wrap this command in a for loop:

for lin in {200..1}; do
   iptables -D fail2ban-somejail $lin
done

Here I made the number 200 up. Check your own output of the command with --line-numbers and note that the last line (with RETURN) should stay. See @roaima's comment below for the reasoning behind counting down.

  • 1
    Careful with that loop. When you delete the first rule, the second one becomes first (if you see what I mean). So either count down from N to 1, or delete the first rule N times: for lin in {1..200}; do iptables -D fail2ban-somejail 1; done – roaima Dec 20 '18 at 8:50
  • Thanks @roaima! I'll update the answer accordingly. – ph0t0nix Dec 20 '18 at 8:57
  • 1
    @roaima Yes it is (at least in zsh and bash): echo {5..1} will result in 5 4 3 2 1 . – ph0t0nix Dec 20 '18 at 9:24
  • You saved me. Thanks a lot. Please add a full command because I had to figure out that I need fail2ban-client in frond of your command. (Because I am a noob) – sebastian.roibu 13 hours ago
13

The best way to unban all IPs, is to set the bantime to 1 second, then all the IP will be freed right away.

fail2ban-client set JailName bantime 1

After that you can set the proper ban time back.

It's better to let fail2ban to do the unban for you. Don't manually edit iptables yourself.

  • 1
    This is the only correct answer here. Fail2ban maintains its own ban database that must be cleared independently. Every answer talking about deleting iptables rules ignores that the moment fail2ban is started back up it will re-add the rules you just deleted back to iptables. Also, not every fail2ban configuration uses iptables to implement bans. – Cliff Armstrong Jan 24 '18 at 10:56
  • 2
    find all jails with fail2ban-client status – Flion Jul 16 '18 at 18:12
  • I just issued this command and am watching the number of IPs in my jail decrease toward zero as fail2ban processes the jail. It does not happen really really fast, but that's OK, there were over five thousand entries in the jail. Good answer! – Eric M Feb 28 at 16:12
4

The latest fail2ban-client (0.10) has a unban -all command. Jails can also be individually "restarted", effectively clearing the bans.

If you have an older version, this trick might work for automatic temporary bans: delete the jail which contains the ban then restart fail2ban so that the (now empty) jail would be recreated.

$ fail2ban-client stop sshd
Jail stopped
$ systemctl restart fail2ban
  • -all or —all? Or --all? – Wildcard Oct 17 at 3:22
3

Save iptable config to file

$ iptables-save > iptables.conf

Edit it with any editor you like Than load config back to iptables

$ iptables-restore < iptables.conf

Do not forget to store configuration inside iptables so it will be picked up on reboot

$ service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
  • This is one of the way one could do this. Thanks. – User9102d82 Jul 15 '17 at 18:51
3

1. stopping the service will clean all rules added by fail2ban

service fail2ban stop

2. if you do not have any other iptables rules, you can flush it

iptables -F

be careful: this will erase any other rules in your iptables.

2

Because of the way fail2ban works, there are only two possible solutions:

  • Make a firewall configuration script that includes fail2ban jails and restart the firewall.
  • Remove the firewall rules blocking the IPs that you wish to unban.
2

heres a simple oneliner to unban the whole fail2ban jail the proper way:

iptables -L f2b-recidive -n | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -v 0.0.0.0 | xargs -n 1 fail2ban-client set recidive unbanip

NOTE: iptables command takes "f2b-" prefix before the jail name while "fail2ban-client" the real jail name

  • This is the best answer for fail2ban versions bellow 0.10. You can go further creating an alias in .bashrc like fail2ban-purge with one parameter to purge a whole jail. Just replace recidive word above with $1 and use alias as fail2ban-purge <JAIL_NAME>. – ADDISON74 Feb 23 at 10:54
2

This is the script I'm using to unban all IP addresses for a ssh jail (simply replace sshd occourence with the name of jail you need... e.g. mysqld-auth)

#!/bin/bash
j=$(iptables -L f2b-sshd | grep -c 'REJECT')
for ((i=1;i<=j;i++))
do
  fail2ban-client set sshd unbanip $(fail2ban-client status sshd | grep 'Banned IP list:' | cut -c23-)
done

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.