How to unban an IP address in HestiaCP Fail2Ban

For security, Fail2Ban is installed by default in the preinstalled HestiaCP image available in the Clouding panel.

Fail2Ban helps us control attacks known as “brute-force attacks” by blocking access to the server after detecting a number of failed remote connection attempts to the server over SSH/FTP/MySQL…

A legitimate user may try to connect several times after entering an incorrect password, eventually causing Fail2Ban to block access.

To unblock access, you only need the affected user's public IP address to identify and resolve the issue.

In this article, we explain two ways to unban an IP address: from the command line (CLI) or from the HestiaCP panel itself.

Unbanning an IP address from the command line (CLI)

Connect to your server over SSH: Access Linux over SSH with PuTTY

Once the SSH connection is established, you need to modify the /list/firewall/banlist file to remove the IP address from the list. To do this, edit the file, delete the IP address you no longer want to block, save the file, and apply the changes. You can do all of this using the script by running the following command:

# v-delete-firewall-ban 198.11.130.250 MAIL

You may also want to view the list of all listed IP addresses:

# v-list-firewall-ban json

You can also add a new IP address to this list if you want to block access:

# v-add-firewall-ban 37.120.129.20 MAIL

Here is a useful link where you can find all the predefined HestiaCP scripts: https://docs.hestiacp.com/cli_commands.html

Unbanning an IP address from the HestiaCP panel itself

Log in to the HestiaCP panel as “admin” and open settings:

Click the “Firewall” button:

The menu will change. Now click the  “Manage Banned IPs” button:

As shown in the following image, you can see the list of blocked IP addresses. When you hover over an IP address, a “delete” icon appears so you can remove it from the list:

Delete the IP address you want to unblock, and access will no longer be blocked. In this example, this would be SSH access.

You can also do the opposite: add an IP address to the list to block access manually

In this same section, you can also add an IP address to the list to block access manually and choose which access you want to block. Click the Add IP to ban list button to add the IP address to the list:

Enter the IP address you want to block in the first field and select the service for which you want to block access:

After making changes, remember to restart the Fail2Ban service. (We explain how to do this in the next section).

More information about Fail2Ban in HestiaCP

From the HestiaCP panel itself, you can restart or stop the service, or modify the Fail2Ban configuration.
In some cases, you may want to stop the Fail2Ban service temporarily. For example, when you cannot connect because it has blocked access and identifying the problem is taking some time. You can always enable it again afterward, as keeping it enabled is important for security.
 

To stop the Fail2Ban service, log in to the HestiaCP panel as admin and open settings, as explained at the beginning, where all the configuration files appear.

The following image shows the icons that appear when you hover over a service. You can edit the configuration file, restart the service, or stop it.
To stop the Fail2Ban service, use the third icon, which is a square. To restart the service, use the second icon, which shows an arrow similar to the one used to undo changes:

In the previous image, the first icon is a pencil. Clicking it opens the following screen, which shows the Fail2Ban configuration file at this path: /etc/fail2ban/jail.local

From here, you can modify the contents and even restart the service if you leave the checkbox selected when saving your changes.
The code also shows that the service is enabled, the maximum number of failed attempts allowed before access is blocked, and the location of the log file, whose history you can review to identify what happened.