How to unban IP locked out by aaPanel Fail2ban via SSH terminal commands

by

The aaPanel Fail2ban plugin automatically monitors log files (such as SSH, FTP, and aaPanel login logs) and inserts netfilter rules into iptables or nftables when a threshold of failed authentication attempts is exceeded. When an administrator is locked out, Fail2ban has written an active drop/reject rule for the client’s public IP into a specific jail chain (such as f2b-sshd or f2b-aaPanel). Because aaPanel manages Fail2ban as a background service via system-level scripts, resetting or clearing the block requires using the fail2ban-client binary or altering iptables rules directly via an out-of-band SSH session or provider console.

Quick Fix

Unban the locked-out IP directly using fail2ban-client by specifying the target jail, or clear the IP from all active jails using a one-liner:

fail2ban-client set <jail_name> unbanip <TARGET_IP>

To unban an IP across all active Fail2ban jails simultaneously:

fail2ban-client unban <TARGET_IP>

Step-by-Step Resolution

  1. Access the Server Out-of-Band
  • If blocked on standard SSH (port 22), connect using a secondary non-blocked IP, a VPN, or your cloud provider’s VNC/Serial Console (e.g., DigitalOcean Console, AWS EC2 Serial Console, or Hetzner VNC).
  1. List Active Jails and Identify the Blocking Jail
  • Query the status of the Fail2ban server to view all enabled jails managed by aaPanel:
fail2ban-client status
  • Inspect specific jails (e.g., sshd, aapanel, ftp) to see which jail holds your IP in its Banned IP list:
fail2ban-client status sshd
fail2ban-client status aapanel
  1. Execute the Unban Command
  • Remove the banned IP from the identified jail:
fail2ban-client set aapanel unbanip 192.0.2.100
  • If the block was triggered by SSH brute-force protection:
fail2ban-client set sshd unbanip 192.0.2.100
  1. Verify and Flush Netfilter Rules (If Jail Unban Fails)
  • Verify that the IP was removed from the netfilter firewall rules:
iptables -L -n -v | grep 192.0.2.100
  • If the IP remains in an iptables chain created by Fail2ban, manually delete the specific drop rule:
iptables -D f2b-sshd -s 192.0.2.100 -j DROP
  1. Whitelist Your Management IP to Prevent Future Lockouts
  • Open the primary Fail2ban configuration managed by aaPanel:
nano /etc/fail2ban/jail.local
  • Locate the ignoreip parameter under the [DEFAULT] section and append your static IP address (separated by a space):
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.0.2.100
  • Restart Fail2ban to persist changes:
systemctl restart fail2ban
  • Verify that the step was successful: Run fail2ban-client status <jail_name> to confirm your IP is no longer present under Banned IP list, and test active authentication over SSH or the aaPanel WebGUI.
See also  Setting up strict Let's Encrypt renewal with Cloudflare API token without global key

Why This Fails for Some Users

  • Dual-Layer Firewalls (UFW / Firewalld / Cloud Security Groups): Clearing an IP from Fail2ban will not restore access if aaPanel’s System Firewall plugin (ufw or firewalld) or an external cloud firewall (AWS Security Groups, Cloudflare, or DigitalOcean Firewalls) independently dropped the IP. Check ufw status or firewall-cmd --list-all separately.
  • Socket File Path Discrepancies: On customized Linux distributions or non-standard aaPanel deployments, running fail2ban-client without root privileges causes connection errors (Failed to inspect server: Could not connect to server). Always run the command with sudo or as the root user.
  • Non-Standard Jail Names Created by aaPanel: aaPanel names its GUI-created jails dynamically (e.g., aaPanel-ssh, aaPanel-panel, panel-login). Running fail2ban-client set sshd unbanip ... will fail if aaPanel created the rule under a custom jail string; always run fail2ban-client status first to retrieve exact jail identifiers.
  • Re-triggering Instant Bans via Persistent Connections: Background applications, active SSH tunnels, or open browser tabs constantly polling aaPanel in the background will immediately trigger a new ban upon sending unauthenticated requests the moment the IP is unbanned. Close all background sessions prior to executing the unban command.

Leave a Comment