2

I have two filters that have banned local addresses. I have added the addresses to ignoreip but the damage was done already and the bans are in place. Every time I reboot my computer I have to do an iptables -L f2b-apache-auth and then drop the two local addresses and again with the other filter.

I can't figure out where it is saving the bans and adding them back when I reboot. Is there a file stored somewhere where I can edit it and remove these addresses from those bans so they won't be added into iptables after every reboot?

And as a follow up question .. it is adding them in iptables as computer's names not ip addresses ... in other words ... its showing as "computer name" not 192.168.x.xxx in the filter under the ignoreregex = I have added the ip addresses of the local machines that I want to not be effected... do I also have to add "computer name" to those entries also or would that cause the filter to fail?

0
4

The bans are stored in a SQLite3 database in /var/lib/fail2ban. To open it you need the package sqlite3 installed and if you want a GUI, use a tool like sqliteman.

The name of that database file is called:

/var/lib/fail2ban/fail2ban.sqlite3
1
  • Thanks you so much ... this is what I needed. After installing these programs I was also able to see how the data was stored and it answered my second question also ... the addresses are stored by IP so ... I do not have to worry about trying to add the computer name in the "ignore" part. – John Orion Apr 24 '16 at 14:22
1

No need for such a low-level approach / manually editing the DB.

With Fail2Ban before v0.8.8:

fail2ban-client get YOURJAILNAMEHERE actionunban IPADDRESSHERE

With Fail2Ban v0.8.8 and later:

fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.