Cfrtjryk

Updated answer

As of version 0.10.0 fail2ban-client features the unban command that can be used in two ways:

unban --all                              unbans all IP addresses (in all

                                         jails and database)

unban <IP> ... <IP>                      unbans <IP> (in all jails and

                                         database)

Moreover, the restart <JAIL>, reload <JAIL> and reload commands now also have the --unban option.

Old Answer

fail2ban uses iptables to block traffic. If you would want to see the IP addresses that are currently blocked, type

iptables -L -n

and look for the various chains named fail2ban-something, where something points to the fail2ban jail (for instance, Chain f2b-sshd refers to the jail sshd).
If you only want to remove the block for a single IP address <IP> for a given jail <JAIL>, fail2ban offers its own client:

fail2ban-client set <JAIL> unbanip <IP>

Alternatively you can use line numbers. First, list the iptables rules with line numbers:

iptables -L -n --line-numbers

Next you can use

iptables -D fail2ban-somejail <linenumber> 

to remove a single line from the table. As far as I know there is no option to select a range of line numbers, so I guess you would have to wrap this command in a for loop:

for lin in {200..1}; do

   iptables -D fail2ban-somejail $lin

done

Here I made the number 200 up. Check your own output of the command with --line-numbers and note that the last line (with RETURN) should stay. See @roaima's comment below for the reasoning behind counting down.

The best way to unban all IPs, is to set the bantime to 1 second, then all the IP will be freed right away.

fail2ban-client set JailName bantime 1

After that you can set the proper ban time back.

It's better to let fail2ban to do the unban for you. Don't manually edit iptables yourself.

Save iptable config to file

$ iptables-save > iptables.conf

Edit it with any editor you like
Than load config back to iptables

$ iptables-restore < iptables.conf

Do not forget to store configuration inside iptables so it will be picked up on reboot

$ service iptables save

iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

Because of the way fail2ban works, there are only two possible solutions:

• Make a firewall configuration script that includes fail2ban jails and restart the firewall.


• Remove the firewall rules blocking the IPs that you wish to unban.

1. stopping the service will clean all rules added by fail2ban

service fail2ban stop

2. if you do not have any other iptables rules, you can flush it

iptables -F

be careful: this will erase any other rules in your iptables.

The latest fail2ban-client (0.10) has a unban -all command. Jails can also be individually "restarted", effectively clearing the bans.

If you have an older version, this trick might work for automatic temporary bans: delete the jail which contains the ban then restart fail2ban so that the (now empty) jail would be recreated.

$ fail2ban-client stop sshd

Jail stopped

$ systemctl restart fail2ban

heres a simple oneliner to unban the whole fail2ban jail the proper way:

iptables -L f2b-recidive -n | grep -o '[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}' | grep -v 0.0.0.0 | xargs -n 1 fail2ban-client set recidive unbanip

NOTE: iptables command takes "f2b-" prefix before the jail name while "fail2ban-client" the real jail name