How to list banned IPs in fail2ban

To list banned IPs in fail2ban, run sudo fail2ban-client status <jail> — for example sudo fail2ban-client status sshd — and read the Banned IP list line. For all jails at once, use sudo fail2ban-client banned. To see when each ban started and when it expires, use sudo fail2ban-client get sshd banip --with-time. All three read the live state of the running server.

$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42

Currently banned is how many addresses are blocked right now; Total banned counts every ban since the jail started. The status page explains each field.

Show banned IPs in all jails#

$ sudo fail2ban-client banned
[{'sshd': ['203.0.113.42']}, {'recidive': []}]

The output is a list with one entry per jail, which also makes it easy to parse in scripts. On fail2ban 1.1.0 and later, status --all prints the full status of every jail in one go:

$ sudo fail2ban-client status --all
Status
|- Number of jail:	2
|- Jail list:	recidive, sshd
`- Status for the jails:
   |- Jail: recidive
   |  |- Filter
   |  |  |- Currently failed:	3
   |  |  |- Total failed:	3
   |  |  `- File list:	/var/log/fail2ban.log
   |  `- Actions
   |     |- Currently banned:	0
   |     |- Total banned:	0
   |     `- Banned IP list:
   `- Jail: sshd
      |- Filter
      |  |- Currently failed:	2
      |  |- Total failed:	6
      |  `- File list:	/var/log/auth.log
      `- Actions
         |- Currently banned:	0
         |- Total banned:	3
         `- Banned IP list:

On older versions (Ubuntu 24.04 and Debian 12 ship 1.0.2), loop over the jails:

for j in $(sudo fail2ban-client status | sed -n 's/.*Jail list:\s*//p' | tr -d ','); do
  echo "== $j"; sudo fail2ban-client get "$j" banip
done

List banned IPs with ban time and expiry#

$ sudo fail2ban-client get sshd banip --with-time
203.0.113.42 	2026-10-25 18:36:10 + 3600 = 2026-10-25 19:36:10
192.0.2.15 	2026-10-25 18:36:14 + 3600 = 2026-10-25 19:36:14
192.0.2.16 	2026-10-25 18:36:14 + 3600 = 2026-10-25 19:36:14

Each line reads: banned at + seconds = unbanned at. The list is ordered by end of ban. A permanent ban shows + -1 = 9999-12-31 23:59:59.

Without --with-time, get <jail> banip prints just the addresses, separated by spaces. You can pass another separator, which is handy for one-per-line output or CSV:

$ sudo fail2ban-client get sshd banip
203.0.113.42 192.0.2.15 192.0.2.16

sudo fail2ban-client get sshd banip ,                 # comma-separated
sudo fail2ban-client get sshd banip | tr ' ' '\n'    # one per line

Check whether one IP is banned#

$ sudo fail2ban-client banned 203.0.113.42
[['sshd']]

The result lists the jails that ban this address; [[]] means none. For a yes/no answer in one jail, get <jail> banned <IP> prints 1 or 0:

sudo fail2ban-client get sshd banned 203.0.113.42

Both compare the exact string. If a jail banned the network 198.51.100.0/24, asking about 198.51.100.7 returns [[]] even though the firewall blocks it.

Count banned IPs#

# currently banned, one jail
sudo fail2ban-client status sshd | grep 'Currently banned'

# currently banned, all jails
sudo fail2ban-client banned | grep -oE "'[0-9a-fA-F]*[:.][0-9a-fA-F:.]*(/[0-9]+)?'" | wc -l

On 1.1.0+, sudo fail2ban-client stats prints one table with the current and total failed and banned counts for every jail.

See banned IPs in the firewall#

fail2ban's list is its intent. The firewall shows what is actually blocked, which is what you want when a banned IP can still connect. The commands depend on your ban action:

sudo nft list set inet f2b-table addr-set-sshd
sudo nft list table inet f2b-table     # every jail

sudo iptables -L f2b-sshd -n --line-numbers
sudo ip6tables -L f2b-sshd -n

sudo ipset list f2b-sshd

sudo firewall-cmd --list-rich-rules

sudo ufw status numbered

If an IP shows in fail2ban but not in the firewall, the action failed — check /var/log/fail2ban.log for errors after the Ban line.

List banned IPs from the fail2ban database#

fail2ban keeps bans in SQLite at /var/lib/fail2ban/fail2ban.sqlite3 so it can restore them after a restart. Two tables matter:

• bips — one row per IP and jail with the latest ban (ip, jail, timeofban, bantime, bancount). This is what gets restored.
• bans — one row per ban event; rows older than dbpurgeage (default 1d) are purged.

Install the sqlite3 command-line tool, then:

# bans that are still active (permanent ones have bantime -1)
sudo sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 \
  "SELECT jail, ip, datetime(timeofban,'unixepoch','localtime'), bantime, bancount
   FROM bips WHERE bantime < 0 OR timeofban + bantime > strftime('%s','now')
   ORDER BY timeofban;"

# most-banned IPs within the purge window
sudo sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 \
  "SELECT ip, COUNT(*) AS n FROM bans GROUP BY ip ORDER BY n DESC LIMIT 20;"

Read the database only; don't edit it while fail2ban runs. To remove a ban there too, use fail2ban-client unban <IP>.

Banned IP history from the log#

For a longer history than the database keeps, use fail2ban's log:

# every ban in the current log
sudo grep '\] Ban ' /var/log/fail2ban.log

# top 10 banned IPs across rotated logs
sudo zgrep -h '\] Ban ' /var/log/fail2ban.log* | awk '{print $NF}' | sort | uniq -c | sort -rn | head

More recipes on fail2ban logs, or paste your log into the log analyzer for a summary.

To remove an address from any of these lists, see unban an IP.

FAQ#

How do I see banned IPs in fail2ban?#

Run sudo fail2ban-client status <jail>, for example sudo fail2ban-client status sshd; the Banned IP list line shows every address the jail blocks. sudo fail2ban-client banned shows the bans of all jails, and get <jail> banip --with-time adds ban and expiry times.

How do I list banned IPs in all jails?#

Run sudo fail2ban-client banned. It returns each jail with its list of banned addresses. On fail2ban 1.1.0 and newer, sudo fail2ban-client status --all prints the full status block of every jail. On 1.0.x, loop over the jail names with get <jail> banip.

How do I check if a specific IP is banned?#

Run sudo fail2ban-client banned <IP>. It returns the jails banning that address, such as [['sshd']], or [[]] if none do. To check the firewall itself, search for the address with nft list ruleset, iptables -S or ufw status, depending on your ban action.

Where does fail2ban store banned IPs?#

In memory while running and in the SQLite database /var/lib/fail2ban/fail2ban.sqlite3 (table bips for current bans). The firewall holds the actual block rules. On restart, fail2ban reads the database and re-applies bans that haven't expired.

Why is the banned IP list empty but Total banned is not zero?#

Total banned counts every ban since the jail started, including ones that have already expired. Currently banned and the Banned IP list only show active bans. If bans disappear quickly, your bantime is short — 10 minutes in the stock jail.conf.