Help my IP is getting banned!

[sbenwellp]

Hello all my IP seems to be getting banned by fail2ban I believe any ideas how I can sort out the problem and find out what is causing it.I found myself in iptables -L works from my office location just home getting blocked image attached.

Thank youuuuu

 

[sbenwellp]

FYI looks like its totally blocked the IP for SSH web access sip etc only way i could get to the server was to vpn to my office

 

[jackurke]

Edit /etc/fail2ban/jail.conf
Add your IP to the "ignoreip =" line and restart fail2ban

 

[sbenwellp]

its also under Chain f2b-sshd


is there a way to find out why fail2ban is blocked it before i white list keen to find what the problem was thank you for your quick reply

 

[jackurke]

You could check the log at /var/log/fail2ban.log

cat /var/log/fail2ban.log| grep {ip}

 

[sbenwellp]

Thanks, I have attached the log output,

From this IP I have a ATA , a Fanvill VoIP phone and I would have been home when the IP was banned with my phone which has GS Wave installed. Does anyone have any idea what would be causing it to ban?

 

[smn]

As someone else mentioned, add your Home IP to ignoreip= and restart fail2ban.

 

[smn]

its also under Chain f2b-sshd

is there a way to find out why fail2ban is blocked it before i white list keen to find what the problem was thank you for your quick reply

In addition to fail2ban log check /var/log/nginx/access.log and error.log and /var/log/auth.log

 

[sbenwellp]

As someone else mentioned, add your Home IP to ignoreip= and restart fail2ban.

Thanks smn I have done that

but as I said im interested in trying to find out what caused it rather then just covering it up and forget about it what are the common triggers for fail to ban to block a ip?

 

[sbenwellp]

In addition to fail2ban log check /var/log/nginx/access.log and error.log and /var/log/auth.log

I've had a look through and there isn't anything in the logs before today :/ only one that had somehting was f2b log which i attached

 

[JamesBorne]

Even when your IP is on the line ignoreip=, it will still end up the file /var/log/fail2ban.log.
E.g. [nginx-dos] Ignore 127.0.0.1 by ip

You will still be able to see what is triggering the ban in the future @sbenwellp.
This comes down to basic admin.
Manually check those files to spot the ban, or create triggers to catch them in all the files mentioned above!