How to whitelist IPs in fail2ban (ignoreip)

To whitelist an IP in fail2ban, add it to ignoreip in the [DEFAULT] section of /etc/fail2ban/jail.local and reload. ignoreip takes a space-separated list of IPs, CIDR subnets and hostnames, for example ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10. fail2ban never bans an address on the list. The server's own addresses are already excluded by ignoreself = true.

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10

sudo fail2ban-client reload

Whitelisting doesn't lift a ban that already exists. If the address is banned right now, unban it as well: sudo fail2ban-client unban 203.0.113.10.

What ignoreip accepts#

Separate entries with spaces or commas, or continue on indented lines:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
           192.168.1.0/24
           10.8.0.0/24            ; WireGuard/OpenVPN clients
           203.0.113.10           ; office
           monitor.example.net    ; uptime checks

There is no IP-range syntax like 192.168.1.10-192.168.1.20; use one or more CIDR blocks instead. fail2ban only sees IP addresses in logs, so there's no way to whitelist a MAC address.

Whitelist your local network#

To never ban anything on your LAN, add the subnet in CIDR form. Find it with ip -4 addr (look for something like 192.168.1.23/24 and write the network as 192.168.1.0/24):

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24

To cover every private range at once: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16. Only do that if no traffic reaches fail2ban through a NAT or proxy on those ranges. Otherwise every attacker would look like a private address and be ignored (see the reverse proxy section below).

ignoreself: the server's own addresses#

ignoreself = true is the default, so you don't need to list the server's own IPs. It covers every address on the server's network interfaces plus whatever localhost and the server's hostname resolve to. It doesn't cover the rest of the subnet; your LAN still needs an ignoreip entry. A full example with ignoreip in context is in the annotated jail.local.

Whitelist a dynamic IP or hostname#

If your home IP changes, use a dynamic DNS name that always points to it:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 home.example.net

fail2ban resolves the name when it checks an IP and caches the answer for 5 minutes, so an IP change is picked up quickly without a reload. Make sure the server can resolve the name, and remember that anyone who controls the DNS record controls your whitelist.

ignorecommand: decide with a script#

For anything a static list can't express, ignorecommand runs a command for each IP about to be banned. Exit code 0 means "ignore this IP", exit code 1 means "go ahead and ban". It only runs when ignoreself and ignoreip didn't already match.

#!/bin/sh
# Exit 0 (= never ban) if $1 is one of the addresses our DDNS names point to.
IP="$1"
for HOST in home.example.net office.example.net; do
  for ADDR in $(getent ahosts "$HOST" | awk '{print $1}' | sort -u); do
    [ "$ADDR" = "$IP" ] && exit 0
  done
done
exit 1

[DEFAULT]
ignorecommand = /usr/local/bin/f2b-ignore-ddns <ip>
ignorecache   = key="<ip>", max-count=100, max-time=5m

sudo chmod 755 /usr/local/bin/f2b-ignore-ddns
/usr/local/bin/f2b-ignore-ddns 203.0.113.10; echo $?

ignorecache stores the command's answer per key (here per IP) for 5 minutes, so a burst of failures doesn't run the script hundreds of times. The command runs as root with a 60-second limit; keep it fast. Any exit code other than 0 or 1 is logged as an error and the IP is not ignored.

Whitelist from a file (fail2ban 1.1.1+)#

Since 1.1.1, ignoreip accepts file: entries. fail2ban reads the file the first time it needs it and reloads it automatically when it changes; no fail2ban-client reload needed.

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 file:/etc/fail2ban/ignore.list

# office and VPN
203.0.113.10
198.51.100.0/24      # partner network
2001:db8:1234::/48
monitor.example.net

Entries are separated by spaces, commas or new lines; text after # or ; is a comment. This is handy when another tool (a script, Ansible, an API) maintains the list. On 1.1.0 and older, file: isn't supported. Use ignorecommand with a grep instead.

Whitelist one jail only (and keep the defaults)#

You can set ignoreip inside a jail. Be aware that a jail value replaces the [DEFAULT] list for that jail, it doesn't add to it:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24

[sshd]
# WRONG: sshd now ignores only 198.51.100.7, and no longer your LAN or localhost
ignoreip = 198.51.100.7

To extend the default list instead, reference it with %(default/ignoreip)s:

[sshd]
enabled  = true
ignoreip = %(default/ignoreip)s 198.51.100.7

This requires ignoreip to be set in [DEFAULT]; otherwise fail2ban refuses the config with Bad value substitution: … 'default/ignoreip' which is not a valid option name. Check the merged result with sudo fail2ban-client -d | grep addignoreip.

Add or remove a whitelisted IP at runtime#

Without editing files (lost at the next restart or reload):

$ sudo fail2ban-client set sshd addignoreip 192.168.1.0/24
These IP addresses/networks are ignored:
|- 127.0.0.0/8
|- 192.168.1.0/24
`- ::1

sudo fail2ban-client get sshd ignoreip               # show the list
sudo fail2ban-client set sshd delignoreip 192.168.1.0/24

These commands work per jail. Repeat them for each jail, or put the address in jail.local to cover them all. The command builder generates them for you.

Whitelisting Cloudflare or a reverse proxy: usually wrong#

A common request is "fail2ban keeps banning Cloudflare IPs, how do I whitelist them?". If your web server logs Cloudflare's or your proxy's address instead of the visitor's, whitelisting the proxy means fail2ban will never ban anyone who comes through it. That's every visitor.

The fix is to make the web server log the real client IP (nginx real_ip_header CF-Connecting-IP with set_real_ip_from for Cloudflare's ranges, Apache mod_remoteip), and then ban at the edge (the Cloudflare action) or in the firewall. Step by step: fail2ban bans the proxy or Cloudflare IP and the Cloudflare guide.

Only whitelist a proxy's address when it's an internal proxy that also authenticates users itself and fail2ban watches the proxy's own log.

ignoreip not working? Checklist#

1. The IP is already banned. ignoreip stops new bans; it doesn't remove existing ones. Run sudo fail2ban-client unban <IP>.
2. Not reloaded, or ignoreip is in the wrong file. Run sudo fail2ban-client reload and confirm with sudo fail2ban-client get sshd ignoreip.
3. A jail overrides it. ignoreip in [sshd] (or in jail.d/*.local) replaces the [DEFAULT] list. Use %(default/ignoreip)s.
4. You're connecting from a different address than you think. Most often IPv6: your client reaches the server over IPv6, so whitelisting your IPv4 address does nothing. Check the IP in the ban log: sudo grep Ban /var/log/fail2ban.log.
5. Your IP changed. Home and mobile connections get new addresses. Use a DDNS hostname or ignorecommand.
6. A proxy rewrites addresses. If logs show the proxy's IP, see the section above.
7. Manual bans. fail2ban-client set <jail> banip bans even whitelisted addresses; the ignore list only applies to bans triggered by log failures.
8. Another jail bans you. Every jail that sets its own ignoreip needs your address, including recidive. If nothing above applies, work through fail2ban not banning / banning the wrong IP.

When fail2ban skips an IP because of the whitelist, it logs it at INFO level:

sudo grep "Ignore" /var/log/fail2ban.log | tail

FAQ#

How do I whitelist an IP in fail2ban?#

Add it to ignoreip under [DEFAULT] in /etc/fail2ban/jail.local, for example ignoreip = 127.0.0.1/8 ::1 203.0.113.10, then run sudo fail2ban-client reload. For a temporary whitelist, use sudo fail2ban-client set <jail> addignoreip <IP>. Unban the IP too if it's currently banned.

How do I whitelist a subnet or IP range in fail2ban?#

Use CIDR notation in ignoreip: 192.168.1.0/24 covers 192.168.1.0–255, 10.0.0.0/8 covers all of 10.x.x.x, and 2001:db8::/32 works for IPv6. Dash ranges like 192.168.1.10-20 aren't supported; split them into CIDR blocks.

Can fail2ban whitelist a hostname or dynamic IP?#

Yes. Put a hostname in ignoreip, for example a dynamic DNS name like home.example.net. fail2ban resolves it when checking an IP and caches the result for 5 minutes, so IP changes are followed automatically. For more complex rules, use ignorecommand with a script that exits 0 for addresses to ignore.

Why is ignoreip not working?#

Common reasons: the IP was already banned (ignoreip doesn't unban), fail2ban wasn't reloaded, a jail section sets its own ignoreip that replaces the default, or you connect over IPv6 while you whitelisted IPv4. Check the active list with sudo fail2ban-client get <jail> ignoreip.

Does ignoreip apply to all jails?#

Yes, when it's set in [DEFAULT], unless a jail sets its own ignoreip. A jail-level value replaces the default for that jail; include %(default/ignoreip)s to keep the default entries. Runtime addignoreip changes apply only to the jail you name.