# How to unban an IP in fail2ban > Unban an IP in fail2ban with fail2ban-client: from one jail, from all jails, unban everything, IPv6 and Docker, and stop the same IP getting banned again. > > Source: https://fail2ban.dev/unban-ip/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1 > fail2ban.dev is an independent guide, not the official fail2ban project. To unban an IP in fail2ban, run `sudo fail2ban-client set unbanip ` — for example `sudo fail2ban-client set sshd unbanip 203.0.113.42`. If you don't know which jail banned it, `sudo fail2ban-client unban 203.0.113.42` removes it from **every** jail and from fail2ban's database in one go. Both commands take effect immediately; no restart is needed. ```bash sudo fail2ban-client set sshd unbanip 203.0.113.42 # unban from all jails (and the ban database) sudo fail2ban-client unban 203.0.113.42 ``` ```text $ sudo fail2ban-client set sshd unbanip 203.0.113.42 1 ``` If your own IP is banned you can't SSH in to run these commands. Use another connection — your hosting provider's web console (VNC/serial console), a second server, or your phone's mobile data (a different public IP) — run the unban, then [add your address to `ignoreip`](/config/whitelist/) so it can't happen again. ## Find out which jail banned the IP You need the jail name for the per-jail command. Ask fail2ban which jails hold the address: ```text $ sudo fail2ban-client banned 203.0.113.42 [['sshd']] ``` ```text $ sudo fail2ban-client banned [{'sshd': ['203.0.113.42']}, {'recidive': []}] ``` ```text $ sudo fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 2 | |- Total failed: 6 | `- File list: /var/log/auth.log `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 203.0.113.42 ``` ## Unban an IP from one jail ```bash ``` ```bash ``` ```text $ sudo fail2ban-client set sshd unbanip --report-absent 192.0.2.99 not banned: ['192.0.2.99'] ``` ```bash ``` ## Unban all IPs (clear every jail) ```bash ``` ```bash ``` > **What about restarting fail2ban?** `systemctl restart fail2ban` does **not** reliably clear bans: fail2ban stores active bans in `/var/lib/fail2ban/fail2ban.sqlite3` and re-applies the ones that haven't expired when it starts. If you want a clean slate, run `fail2ban-client unban --all`. To restart a single jail and drop its bans, use `sudo fail2ban-client restart --unban sshd`. ## Unban an IPv6 address IPv6 works the same way — write the address exactly as fail2ban shows it in `status`: ```bash ``` If you run fail2ban in a container (for example the `crazymax/fail2ban` or `linuxserver/fail2ban` images), run the same client inside it: ```bash docker exec -it fail2ban fail2ban-client set sshd unbanip 203.0.113.42 ``` ## Check that the unban worked 1. **fail2ban's view:** `sudo fail2ban-client banned 203.0.113.42` should print `[]`. 2. **The firewall's view:** fail2ban removes the firewall rule when it unbans. You can confirm with the tool your [ban action](/config/banaction/) uses: ```bash sudo nft list ruleset | grep 203.0.113.42 # iptables / ipset (older systems, e.g. Ubuntu 22.04) sudo iptables -S | grep 203.0.113.42 sudo ipset list | grep 203.0.113.42 # ufw sudo ufw status | grep 203.0.113.42 ``` 3. **The log:** fail2ban writes every unban to its log: ```bash ``` 2026-10-25 19:36:11,031 fail2ban.actions [1997]: NOTICE [sshd] Unban 203.0.113.42 ``` An unban only removes the current ban. If the same client keeps failing logins, the jail bans it again as soon as it reaches `maxretry` failures within `findtime`. To unban an IP "permanently", tell fail2ban to ignore it: ```ini [DEFAULT] ignoreip = 127.0.0.1/8 ::1 203.0.113.42 192.168.1.0/24 ``` ```bash ``` ## When does fail2ban unban automatically? Every ban expires on its own after `bantime` (10 minutes in the stock `jail.conf`; many distributions and guides raise it). You can see the exact expiry of each ban: ```text $ sudo fail2ban-client get sshd banip --with-time 203.0.113.42 2026-10-25 18:36:10 + 3600 = 2026-10-25 19:36:10 ``` ## Unban command reference | Task | Command | |---|---| | Unban from one jail | `fail2ban-client set unbanip ` | | Unban several IPs | `fail2ban-client set unbanip …` | | Unban from all jails + database | `fail2ban-client unban ` | | Unban everything | `fail2ban-client unban --all` | | Unban everything in one jail | `fail2ban-client set unbanip $(fail2ban-client get banip)` | | Restart a jail and drop its bans | `fail2ban-client restart --unban ` | | Which jails ban this IP? | `fail2ban-client banned ` | | Never ban this IP (runtime) | `fail2ban-client set addignoreip ` | Prefer clicking to typing? The [command builder](/tools/command-builder/) generates these for your jail and IP. ## FAQ ### What is the command to unban an IP in fail2ban? `sudo fail2ban-client set unbanip ` removes the ban from one jail, for example `sudo fail2ban-client set sshd unbanip 203.0.113.42`. `sudo fail2ban-client unban ` removes it from all jails and the database. Both apply instantly without restarting fail2ban. ### How do I unban all IPs in fail2ban? Run `sudo fail2ban-client unban --all`. It lifts every ban in every jail and removes them from fail2ban's database, so they aren't restored on restart. To clear only one jail, pass its list back to unbanip: `sudo fail2ban-client set sshd unbanip $(sudo fail2ban-client get sshd banip)`. ### Why does fail2ban print 0 when I unban an IP? The number is how many addresses were unbanned. `0` means the IP wasn't banned in that jail — it may be in another jail, already expired, or typed differently. Check with `sudo fail2ban-client banned `, or use `fail2ban-client unban ` to clear it from every jail. ### Does restarting fail2ban unban everyone? No. fail2ban saves active bans in its SQLite database and re-applies any that haven't expired when the service starts again. Use `fail2ban-client unban --all` to clear all bans, or `fail2ban-client restart --unban ` for one jail. ### How do I unban an IP permanently? Unban it, then add it to `ignoreip` in `/etc/fail2ban/jail.local` (under `[DEFAULT]` or the jail) and run `sudo fail2ban-client reload`. fail2ban never bans addresses on the ignore list, so the same IP won't be banned again. ### How long does a fail2ban ban last? As long as the jail's `bantime`: 10 minutes by default in `jail.conf`, often set to an hour or a day in `jail.local`. `bantime = -1` makes bans permanent. `fail2ban-client get banip --with-time` shows when each current ban ends.