How to unban an IP in fail2ban

To unban an IP in fail2ban, run sudo fail2ban-client set <jail> unbanip <IP> — for example sudo fail2ban-client set sshd unbanip 203.0.113.42. If you don't know which jail banned it, sudo fail2ban-client unban 203.0.113.42 removes it from every jail and from fail2ban's database in one go. Both commands take effect immediately; no restart is needed.

# unban from one jail
sudo fail2ban-client set sshd unbanip 203.0.113.42

# unban from all jails (and the ban database)
sudo fail2ban-client unban 203.0.113.42

The client answers with a number: how many addresses it actually unbanned. 1 means the ban is gone; 0 means that IP wasn't banned in that jail.

$ sudo fail2ban-client set sshd unbanip 203.0.113.42
1

Find out which jail banned the IP#

You need the jail name for the per-jail command. Ask fail2ban which jails hold the address:

$ sudo fail2ban-client banned 203.0.113.42
[['sshd']]

Or list every ban in every jail:

$ sudo fail2ban-client banned
[{'sshd': ['203.0.113.42']}, {'recidive': []}]

To see the full status of one jail, including the banned IP list, use status:

$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42

More ways to list bans — including ban start and expiry times — are on list banned IPs.

Unban an IP from one jail#

sudo fail2ban-client set <jail> unbanip <IP>

The jail name is the section name in your config (sshd, nginx-http-auth, recidive…), not the filter file name. You can pass several addresses at once:

sudo fail2ban-client set sshd unbanip 203.0.113.42 198.51.100.7 2001:db8::25

By default the command silently returns 0 for an address that isn't banned. Add --report-absent if you want an explicit error instead — handy in scripts:

$ sudo fail2ban-client set sshd unbanip --report-absent 192.0.2.99
not banned: ['192.0.2.99']

Unban an IP from all jails#

sudo fail2ban-client unban 203.0.113.42

unban (without set and a jail) removes the address from every jail and deletes it from fail2ban's SQLite database, so the ban isn't restored on the next restart. This is the command to reach for when a user says "I'm blocked" and you don't want to hunt for the jail. It's also the right choice when the IP was caught by several jails — for example sshd and recidive — because unbanning it from only one of them leaves the other ban in place.

Unban all IPs (clear every jail)#

sudo fail2ban-client unban --all

This lifts every ban in every jail and clears them from the database. The output is the number of addresses unbanned. There is no built-in "unban all in one jail" command, but you can feed the jail's list back into unbanip:

sudo fail2ban-client set sshd unbanip $(sudo fail2ban-client get sshd banip)

fail2ban-client get sshd banip prints the banned addresses separated by spaces, which is exactly what unbanip accepts.

Unban an IPv6 address#

IPv6 works the same way — write the address exactly as fail2ban shows it in status:

sudo fail2ban-client set sshd unbanip 2001:db8::25

Unban an IP when fail2ban runs in Docker#

If you run fail2ban in a container (for example the crazymax/fail2ban or linuxserver/fail2ban images), run the same client inside it:

docker exec -it fail2ban fail2ban-client status
docker exec -it fail2ban fail2ban-client set sshd unbanip 203.0.113.42

Replace fail2ban with your container name (docker ps shows it). With Docker Compose: docker compose exec fail2ban fail2ban-client unban 203.0.113.42. More on this setup in fail2ban with Docker.

Check that the unban worked#

1. fail2ban's view: sudo fail2ban-client banned 203.0.113.42 should print [].
2. The firewall's view: fail2ban removes the firewall rule when it unbans. You can confirm with the tool your ban action uses:

# nftables (default on Debian 13 and Ubuntu 24.04+)
sudo nft list ruleset | grep 203.0.113.42

# iptables / ipset (older systems, e.g. Ubuntu 22.04)
sudo iptables -S | grep 203.0.113.42
sudo ipset list | grep 203.0.113.42

# ufw
sudo ufw status | grep 203.0.113.42

No output means the address is no longer blocked. If it's still in the firewall even though fail2ban says it isn't banned, a stale rule was left behind (usually after a crash or a changed banaction) — delete it by hand or restart the firewall service.

3. The log: fail2ban writes every unban to its log:

sudo grep 'Unban 203.0.113.42' /var/log/fail2ban.log

2026-10-25 19:36:11,031 fail2ban.actions        [1997]: NOTICE  [sshd] Unban 203.0.113.42

Stop the IP from being banned again#

An unban only removes the current ban. If the same client keeps failing logins, the jail bans it again as soon as it reaches maxretry failures within findtime. To unban an IP "permanently", tell fail2ban to ignore it:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.42 192.168.1.0/24

Then reload: sudo fail2ban-client reload. You can also add it at runtime without touching files (lost on restart):

sudo fail2ban-client set sshd addignoreip 203.0.113.42

Whitelisting has trade-offs — read how to whitelist IPs with ignoreip before you add whole networks. And if a legitimate user keeps getting banned, it's often worth finding out why: an app with a saved wrong password, a monitoring check, or a reverse proxy that makes every visitor look like the same IP (see this fix).

When does fail2ban unban automatically?#

Every ban expires on its own after bantime (10 minutes in the stock jail.conf; many distributions and guides raise it). You can see the exact expiry of each ban:

$ sudo fail2ban-client get sshd banip --with-time
203.0.113.42 	2026-10-25 18:36:10 + 3600 = 2026-10-25 19:36:10

That reads: banned at 18:36:10 for 3600 seconds, unbanned at 19:36:10. Bans with bantime = -1 never expire and must be lifted by hand. If you use incremental bans, repeat offenders get longer bans each time — use the bantime calculator to see how long.

Unban command reference#

Prefer clicking to typing? The command builder generates these for your jail and IP.

FAQ#

What is the command to unban an IP in fail2ban?#

sudo fail2ban-client set <jail> unbanip <IP> removes the ban from one jail, for example sudo fail2ban-client set sshd unbanip 203.0.113.42. sudo fail2ban-client unban <IP> removes it from all jails and the database. Both apply instantly without restarting fail2ban.

How do I unban all IPs in fail2ban?#

Run sudo fail2ban-client unban --all. It lifts every ban in every jail and removes them from fail2ban's database, so they aren't restored on restart. To clear only one jail, pass its list back to unbanip: sudo fail2ban-client set sshd unbanip $(sudo fail2ban-client get sshd banip).

Why does fail2ban print 0 when I unban an IP?#

The number is how many addresses were unbanned. 0 means the IP wasn't banned in that jail — it may be in another jail, already expired, or typed differently. Check with sudo fail2ban-client banned <IP>, or use fail2ban-client unban <IP> to clear it from every jail.

Does restarting fail2ban unban everyone?#

No. fail2ban saves active bans in its SQLite database and re-applies any that haven't expired when the service starts again. Use fail2ban-client unban --all to clear all bans, or fail2ban-client restart --unban <jail> for one jail.

How do I unban an IP permanently?#

Unban it, then add it to ignoreip in /etc/fail2ban/jail.local (under [DEFAULT] or the jail) and run sudo fail2ban-client reload. fail2ban never bans addresses on the ignore list, so the same IP won't be banned again.

How long does a fail2ban ban last?#

As long as the jail's bantime: 10 minutes by default in jail.conf, often set to an hour or a day in jail.local. bantime = -1 makes bans permanent. fail2ban-client get <jail> banip --with-time shows when each current ban ends.