# How to whitelist IPs in fail2ban (ignoreip) > Whitelist IPs in fail2ban with ignoreip: single IPs, subnets, your LAN, hostnames, dynamic IPs, file: lists, ignorecommand, and why ignoreip seems ignored. > > Source: https://fail2ban.dev/config/whitelist/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1 > fail2ban.dev is an independent guide, not the official fail2ban project. To whitelist an IP in fail2ban, add it to **`ignoreip`** in the `[DEFAULT]` section of `/etc/fail2ban/jail.local` and reload. `ignoreip` takes a space-separated list of IPs, CIDR subnets and hostnames, for example `ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10`. fail2ban never bans an address on the list. The server's own addresses are already excluded by `ignoreself = true`. ```ini [DEFAULT] ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 203.0.113.10 ``` sudo fail2ban-client reload ``` ## What ignoreip accepts | Entry | Example | Matches | |---|---|---| | Single IPv4 | `203.0.113.10` | That address | | Single IPv6 | `2001:db8::25` | That address | | IPv4 subnet (CIDR) | `192.168.1.0/24` | 192.168.1.0 – 192.168.1.255 | | Large range | `10.0.0.0/8` | 10.0.0.0 – 10.255.255.255 | | IPv6 prefix | `2001:db8:1234::/48` | Every address in the /48 | | Loopback | `127.0.0.1/8 ::1` | Local connections | | Hostname | `office.example.com` | Whatever the name resolves to (re-resolved, cached for 5 minutes) | | File (1.1.1+) | `file:/etc/fail2ban/ignore.list` | Every entry in that file | Separate entries with spaces or commas, or continue on indented lines: ```ini [DEFAULT] ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 10.8.0.0/24 ; WireGuard/OpenVPN clients 203.0.113.10 ; office monitor.example.net ; uptime checks ``` ## Whitelist your local network To never ban anything on your LAN, add the subnet in CIDR form. Find it with `ip -4 addr` (look for something like `192.168.1.23/24` and write the network as `192.168.1.0/24`): ```ini ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 ``` ## ignoreself: the server's own addresses `ignoreself = true` is the default, so you don't need to list the server's own IPs. It covers every address on the server's network interfaces plus whatever `localhost` and the server's hostname resolve to. It doesn't cover the rest of the subnet; your LAN still needs an `ignoreip` entry. A full example with `ignoreip` in context is in the [annotated jail.local](/config/jail-local/). ## Whitelist a dynamic IP or hostname If your home IP changes, use a dynamic DNS name that always points to it: ```ini ignoreip = 127.0.0.1/8 ::1 home.example.net ``` ### ignorecommand: decide with a script For anything a static list can't express, `ignorecommand` runs a command for each IP about to be banned. **Exit code 0 means "ignore this IP"**, exit code 1 means "go ahead and ban". It only runs when `ignoreself` and `ignoreip` didn't already match. ```bash #!/bin/sh # Exit 0 (= never ban) if $1 is one of the addresses our DDNS names point to. IP="$1" for HOST in home.example.net office.example.net; do for ADDR in $(getent ahosts "$HOST" | awk '{print $1}' | sort -u); do [ "$ADDR" = "$IP" ] && exit 0 done done exit 1 ``` [DEFAULT] ignorecommand = /usr/local/bin/f2b-ignore-ddns ignorecache = key="", max-count=100, max-time=5m ``` sudo chmod 755 /usr/local/bin/f2b-ignore-ddns /usr/local/bin/f2b-ignore-ddns 203.0.113.10; echo $? ``` ## Whitelist from a file (fail2ban 1.1.1+) Since 1.1.1, `ignoreip` accepts `file:` entries. fail2ban reads the file the first time it needs it and reloads it automatically when it changes; no `fail2ban-client reload` needed. ```ini [DEFAULT] ignoreip = 127.0.0.1/8 ::1 file:/etc/fail2ban/ignore.list ``` # office and VPN 203.0.113.10 198.51.100.0/24 # partner network 2001:db8:1234::/48 monitor.example.net ``` ## Whitelist one jail only (and keep the defaults) You can set `ignoreip` inside a jail. Be aware that a jail value **replaces** the `[DEFAULT]` list for that jail, it doesn't add to it: ```ini [DEFAULT] ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 [sshd] # WRONG: sshd now ignores only 198.51.100.7, and no longer your LAN or localhost ignoreip = 198.51.100.7 ``` ```ini [sshd] enabled = true ignoreip = %(default/ignoreip)s 198.51.100.7 ``` ## Add or remove a whitelisted IP at runtime Without editing files (lost at the next restart or reload): ```text $ sudo fail2ban-client set sshd addignoreip 192.168.1.0/24 These IP addresses/networks are ignored: |- 127.0.0.0/8 |- 192.168.1.0/24 `- ::1 ``` sudo fail2ban-client get sshd ignoreip # show the list sudo fail2ban-client set sshd delignoreip 192.168.1.0/24 ``` ## Whitelisting Cloudflare or a reverse proxy: usually wrong A common request is "fail2ban keeps banning Cloudflare IPs, how do I whitelist them?". If your web server logs Cloudflare's or your proxy's address instead of the visitor's, whitelisting the proxy means fail2ban will **never ban anyone** who comes through it. That's every visitor. The fix is to make the web server log the real client IP (nginx `real_ip_header CF-Connecting-IP` with `set_real_ip_from` for Cloudflare's ranges, Apache `mod_remoteip`), and then ban at the edge (the Cloudflare action) or in the firewall. Step by step: [fail2ban bans the proxy or Cloudflare IP](/troubleshooting/reverse-proxy-ip/) and the [Cloudflare guide](/guides/cloudflare/). Only whitelist a proxy's address when it's an internal proxy that also authenticates users itself and fail2ban watches the proxy's own log. ## ignoreip not working? Checklist 1. **The IP is already banned.** `ignoreip` stops new bans; it doesn't remove existing ones. Run `sudo fail2ban-client unban `. 2. **Not reloaded**, or `ignoreip` is in the wrong file. Run `sudo fail2ban-client reload` and confirm with `sudo fail2ban-client get sshd ignoreip`. 3. **A jail overrides it.** `ignoreip` in `[sshd]` (or in `jail.d/*.local`) replaces the `[DEFAULT]` list. Use `%(default/ignoreip)s`. 4. **You're connecting from a different address than you think.** Most often IPv6: your client reaches the server over IPv6, so whitelisting your IPv4 address does nothing. Check the IP in the ban log: `sudo grep Ban /var/log/fail2ban.log`. 5. **Your IP changed.** Home and mobile connections get new addresses. Use a DDNS hostname or `ignorecommand`. 6. **A proxy rewrites addresses.** If logs show the proxy's IP, see the section above. 7. **Manual bans.** `fail2ban-client set banip` bans even whitelisted addresses; the ignore list only applies to bans triggered by log failures. 8. **Another jail bans you.** Every jail that sets its own `ignoreip` needs your address, including [recidive](/config/recidive/). If nothing above applies, work through [fail2ban not banning / banning the wrong IP](/troubleshooting/not-banning/). When fail2ban skips an IP because of the whitelist, it logs it at INFO level: ```bash ``` ### How do I whitelist an IP in fail2ban? Add it to `ignoreip` under `[DEFAULT]` in `/etc/fail2ban/jail.local`, for example `ignoreip = 127.0.0.1/8 ::1 203.0.113.10`, then run `sudo fail2ban-client reload`. For a temporary whitelist, use `sudo fail2ban-client set addignoreip `. Unban the IP too if it's currently banned. ### How do I whitelist a subnet or IP range in fail2ban? Use CIDR notation in `ignoreip`: `192.168.1.0/24` covers 192.168.1.0–255, `10.0.0.0/8` covers all of 10.x.x.x, and `2001:db8::/32` works for IPv6. Dash ranges like `192.168.1.10-20` aren't supported; split them into CIDR blocks. ### Can fail2ban whitelist a hostname or dynamic IP? Yes. Put a hostname in `ignoreip`, for example a dynamic DNS name like `home.example.net`. fail2ban resolves it when checking an IP and caches the result for 5 minutes, so IP changes are followed automatically. For more complex rules, use `ignorecommand` with a script that exits 0 for addresses to ignore. ### Why is ignoreip not working? Common reasons: the IP was already banned (ignoreip doesn't unban), fail2ban wasn't reloaded, a jail section sets its own `ignoreip` that replaces the default, or you connect over IPv6 while you whitelisted IPv4. Check the active list with `sudo fail2ban-client get ignoreip`. ### Does ignoreip apply to all jails? Yes, when it's set in `[DEFAULT]`, unless a jail sets its own `ignoreip`. A jail-level value replaces the default for that jail; include `%(default/ignoreip)s` to keep the default entries. Runtime `addignoreip` changes apply only to the jail you name.