Linux remove IP from fail2ban f2b

Posted by Damodar Bashyal on February 01, 2017

 

First check if your IP has been banned:

$ iptables -L -n

Chain f2b-sshd (2 references)
target     prot opt source               destination
REJECT     all  --  106.31.116.9         0.0.0.0/0           reject-with icmp-port-unreachable
REJECT     all  --  109.228.208.170      0.0.0.0/0           reject-with icmp-port-unreachable
REJECT     all  --  103.99.182.6         0.0.0.0/0           reject-with icmp-port-unreachable
REJECT     all  --  105.159.235.233      0.0.0.0/0           reject-with icmp-port-unreachable
RETURN     all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

If your IP has been banned then find line number of your IP entry in the banned list using command below, depending on the jail (Chain target) name you see from previous command.

$ iptables -L f2b-sshd -v -n --line-numbers
// if your target name is 'fail2ban-SSH', then use.
// $ iptables -L fail2ban-SSH -v -n --line-numbers

Chain f2b-sshd (2 references)
num   pkts bytes target     prot opt in     out     source               destination
1      130  8952 REJECT     all  --  *      *       116.31.116.9         0.0.0.0/0           reject-with icmp-port-unreachable
2        0     0 REJECT     all  --  *      *       153.99.182.6         0.0.0.0/0           reject-with icmp-port-unreachable
3        0     0 REJECT     all  --  *      *       115.159.235.233      0.0.0.0/0           reject-with icmp-port-unreachable
4     6571  533K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
5        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Now, you can use `iptables -D chain rulenum` to delete the entry with your IP address.

$ iptables -D f2b-sshd 1
// if your target name is 'fail2ban-SSH', then use.
// iptables -D fail2ban-SSH 1

This will delete line 1:

`1      130  8952 REJECT     all  --  *      *       16.31.116.9         0.0.0.0/0           reject-with icmp-port-unreachable`

If you need to remove another IP address from the banned ssh/sshd IP list, then you need to run `iptables -L f2b-sshd -v -n --line-numbers` again as line numbers are changed everytime you delete one entry.

Above code was successfully tested on: CentOS x86_64 release 6.8 (Final)

 
not published on website


QR Code: Linux remove IP from fail2ban f2b