How to View, Unban, Whitelist, and Manage Banned IP Addresses on an ISPConfig 3 VPS with Apache

If you run a VPS with ISPConfig 3, Apache, SSH, mail services, FTP, and automation tools, sooner or later you may lock yourself out. This happens even more often now that AI agents, coding assistants, deployment bots, and automation tools try to connect repeatedly with incorrect credentials.

A common example:

“My home IP was accidentally blocked because an AI coding agent kept trying to SSH into my VPS, but the credentials were wrong.”

In most cases, the block does not come directly from Apache or ISPConfig. It usually comes from Fail2Ban, a security tool that watches logs for repeated failed login attempts and then bans suspicious IP addresses by adding firewall rules. Fail2Ban commonly protects services like SSH, Apache authentication, mail, FTP, and ISPConfig-related login endpoints. Fail2Ban is designed to monitor logs and ban IPs that show suspicious behavior such as repeated failed login attempts. ([Linux Command Library]](https://www.quora.com/Is-the-following-sentence-correct-please-review-the-attached-documents-when-you-get-a-chance-and-let-me-know-your-inputs) guide shows you how to:

• See which IPs are banned
• Find out why an IP was banned
• Unban your home IP
• Unban an IP from all Fail2Ban jails
• Manually ban an IP
• Whitelist your own IP
• Check iptables, nftables, UFW, and firewalld
• Prevent AI agents and automation tools from repeatedly locking you out

Quick Answer: How to Unban Your IP from Fail2Ban

Replace YOUR.HOME.IP.ADDR with your actual IP address.

sudo fail2ban-client status

Find the jail that banned you, for example sshd, then run:

sudo fail2ban-client set sshd unbanip YOUR.HOME.IP.ADDR

If you are not sure which jail banned the IP, unban it from every active jail:

IP="YOUR.HOME.IP.ADDR"

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  sudo fail2ban-client set "$jail" unbanip "$IP"
done

The standard Fail2Ban command format for unbanning is:

sudo fail2ban-client set <jail> unbanip <IP>

This is the safest method because it tells Fail2Ban to remove the ban instead of manually editing firewall rules underneath it. ([Server Fault]](http://mbdeiana.com/emu-bay/please-review-the-attached-document-and-let-me-know.php))

1. What Is Actually Blocking the IP?

On an ISPConfig 3 VPS, an IP can be blocked in several places:

Most accidental lockouts are caused by Fail2Ban, especially when repeated bad login attempts happen over SSH, mail, FTP, or web authentication.

AI agents and coding assistants often trigger this because they may repeatedly try to connect using:

• The wrong SSH username
• The wrong SSH key
• Password authentication when the server expects key authentication
• An old deployment key
• A missing authorized_keys entry
• A stale server fingerprint
• An incorrect port
• An invalid FTP, SFTP, SMTP, IMAP, or panel login

2. How to Check If Fail2Ban Is Installed and Running

First, check whether Fail2Ban is active:

sudo systemctl status fail2ban

You can also check whether the Fail2Ban client can talk to the server:

sudo fail2ban-client ping

Expected result:

Server replied: pong

If Fail2Ban is not running, start it:

sudo systemctl start fail2ban

Enable it at boot:

sudo systemctl enable fail2ban

3. How to List All Active Fail2Ban Jails

Fail2Ban organizes protections into jails. A jail is a rule set for one service or type of attack.

List all active jails:

sudo fail2ban-client status

Example output:

Status
|- Number of jail:      5
`- Jail list:   sshd, apache-auth, postfix-sasl, dovecot, pure-ftpd

Common ISPConfig-related jails may include:

sshd
apache-auth
apache-badbots
apache-noscript
apache-overflows
postfix
postfix-sasl
dovecot
pure-ftpd
roundcube-auth
ispconfig

The exact names depend on your distribution, ISPConfig setup, and Fail2Ban configuration.

4. How to List Banned IPs in a Specific Fail2Ban Jail

To check the SSH jail:

sudo fail2ban-client status sshd

Example output:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 2
|  |- Total failed:     18
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     3
   `- Banned IP list:   203.0.113.45

The important line is:

Banned IP list:

To check Apache authentication bans:

sudo fail2ban-client status apache-auth

To check mail authentication bans:

sudo fail2ban-client status postfix-sasl
sudo fail2ban-client status dovecot

To check FTP bans:

sudo fail2ban-client status pure-ftpd

5. How to Check Every Jail for a Specific Banned IP

Use this when your home IP or office IP is blocked, but you do not know which jail caused it.

IP="YOUR.HOME.IP.ADDR"

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  echo "Checking jail: $jail"
  sudo fail2ban-client status "$jail" | grep -w "$IP" && echo "FOUND in $jail"
done

If the IP appears under a jail, that jail is currently banning it.

6. How to Unban an IP from One Fail2Ban Jail

If your IP is banned from SSH:

sudo fail2ban-client set sshd unbanip YOUR.HOME.IP.ADDR

If your IP is banned from Apache auth:

sudo fail2ban-client set apache-auth unbanip YOUR.HOME.IP.ADDR

If your IP is banned from mail authentication:

sudo fail2ban-client set postfix-sasl unbanip YOUR.HOME.IP.ADDR
sudo fail2ban-client set dovecot unbanip YOUR.HOME.IP.ADDR

If your IP is banned from FTP:

sudo fail2ban-client set pure-ftpd unbanip YOUR.HOME.IP.ADDR

General syntax:

sudo fail2ban-client set <jail> unbanip <IP>

7. How to Unban an IP from All Active Fail2Ban Jails

This is the best command when you just want your home IP restored immediately.

IP="YOUR.HOME.IP.ADDR"

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  echo "Unbanning $IP from $jail"
  sudo fail2ban-client set "$jail" unbanip "$IP"
done

Then verify:

IP="YOUR.HOME.IP.ADDR"

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  echo "=== $jail ==="
  sudo fail2ban-client status "$jail" | grep -w "$IP" || echo "Not found"
done

8. How to List All Currently Banned IPs Across All Jails

Some Fail2Ban versions (0.11+) support:

sudo fail2ban-client banned

If that does not work on your version, use this portable script:

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  echo
  echo "=== $jail ==="
  sudo fail2ban-client status "$jail" | grep "Banned IP list"
done

Cleaner version that only shows jails with active bans:

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  banned=$(sudo fail2ban-client status "$jail" | sed -n 's/^.*Banned IP list:[[:space:]]*//p')
  if [ -n "$banned" ]; then
    echo "$jail: $banned"
  fi
done

9. How to Find Out Why an IP Was Banned

Fail2Ban usually logs ban and unban events here:

/var/log/fail2ban.log

Search for your IP:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/fail2ban.log

Show recent bans:

sudo grep "Ban " /var/log/fail2ban.log | tail -50

Show recent unbans:

sudo grep "Unban " /var/log/fail2ban.log | tail -50

Show all events for one IP:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/fail2ban.log

Example output:

2026-05-18 10:42:11,123 fail2ban.actions [1234]: NOTICE [sshd] Ban 203.0.113.45
2026-05-18 11:42:11,456 fail2ban.actions [1234]: NOTICE [sshd] Unban 203.0.113.45

That tells you:

• The IP address
• The jail that banned it
• The date and time of the ban
• The date and time of the unban

10. How to Check SSH Logs for Failed AI Agent Login Attempts

If an AI agent, deployment bot, or coding assistant caused the issue, the ban is usually in the sshd jail.

On Debian or Ubuntu systems, check:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/auth.log

Watch SSH logs live while testing:

sudo tail -f /var/log/auth.log

On systems using the systemd journal:

sudo journalctl -u ssh --since "today"

Or follow live:

sudo journalctl -u ssh -f

Note: On some distributions, the SSH service is named sshd instead of ssh. Use sudo systemctl status ssh or sudo systemctl status sshd to confirm which name applies to your system.

Some newer Debian-based systems may use the systemd journal instead of traditional /var/log/auth.log paths for SSH logging. If Fail2Ban is not reading the expected log file, the sshd jail may need backend = systemd. ([GitHub])

Example sshd jail override:

[sshd]
enabled = true
backend = systemd

Then reload Fail2Ban:

sudo fail2ban-client reload

11. How to Check Apache Logs for Web-Based Bans

Apache-related Fail2Ban jails may ban IPs for repeated failed basic authentication, bad bots, suspicious requests, missing scripts, or exploit probes.

Common Apache log locations:

/var/log/apache2/access.log
/var/log/apache2/error.log

Check your IP:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/apache2/access.log
sudo grep "YOUR.HOME.IP.ADDR" /var/log/apache2/error.log

Check recent authentication failures:

sudo grep -i "auth" /var/log/apache2/error.log | tail -50

Check repeated 401 responses:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/apache2/access.log | grep " 401 "

Check repeated 403 responses:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/apache2/access.log | grep " 403 "

12. How to Check Mail Logs for Postfix, Dovecot, and Roundcube Bans

ISPConfig servers often run mail services. AI agents, mail clients, old phones, or bad SMTP credentials can trigger bans.

Common mail log path:

/var/log/mail.log

Search for your IP:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/mail.log

Check Postfix SASL failures:

sudo grep -i "sasl" /var/log/mail.log | grep "YOUR.HOME.IP.ADDR"

Check Dovecot login failures:

sudo grep -i "dovecot" /var/log/mail.log | grep "YOUR.HOME.IP.ADDR"

Watch mail logs live:

sudo tail -f /var/log/mail.log

13. How to Check FTP Logs for Pure-FTPd Bans

ISPConfig often uses Pure-FTPd.

Possible logs:

/var/log/syslog
/var/log/messages
/var/log/pure-ftpd/transfer.log

Search for your IP:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/syslog

Check the Pure-FTPd jail:

sudo fail2ban-client status pure-ftpd

Unban from Pure-FTPd:

sudo fail2ban-client set pure-ftpd unbanip YOUR.HOME.IP.ADDR

14. How to Whitelist Your Home IP in Fail2Ban

If your home IP is static or mostly stable, you can whitelist it so Fail2Ban never bans it.

Fail2Ban whitelisting is normally handled with the ignoreip setting in the [DEFAULT] section of a local jail configuration file. Local override files such as jail.local are commonly used so package updates do not overwrite your changes. ([T the local config:

sudo nano /etc/fail2ban/jail.local

Find or create:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 YOUR.HOME.IP.ADDR

You can add multiple trusted IPs separated by spaces:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.10 198.51.100.25

Reload Fail2Ban:

sudo fail2ban-client reload

Verify:

sudo fail2ban-client status

Important warning: Do not whitelist an IP unless you trust it. Also be careful if your home IP changes frequently. If your ISP gives you dynamic IP addresses, a future stranger could receive your old IP and bypass all Fail2Ban protections.

15. How to Whitelist an IP for Only One Jail

Sometimes you only want to prevent SSH lockouts, not whitelist the IP for every service.

Create or edit a jail override:

sudo nano /etc/fail2ban/jail.d/sshd.local

Add:

[sshd]
ignoreip = 127.0.0.1/8 ::1 YOUR.HOME.IP.ADDR

Reload:

sudo fail2ban-client reload sshd

Or reload all:

sudo fail2ban-client reload

16. How to Manually Ban an IP with Fail2Ban

To manually ban a suspicious IP from SSH:

sudo fail2ban-client set sshd banip 203.0.113.45

To manually ban from Apache auth:

sudo fail2ban-client set apache-auth banip 203.0.113.45

General syntax:

sudo fail2ban-client set <jail> banip <IP>

Use this carefully. In many cases, it is better to let Fail2Ban handle bans automatically based on log evidence.

17. How to Check Firewall-Level Blocks (iptables, nftables, UFW, firewalld)

If Fail2Ban does not show the IP as banned, check the firewall directly.

iptables

sudo iptables -L -n --line-numbers | grep "YOUR.HOME.IP.ADDR"

Show all Fail2Ban chains:

sudo iptables -L -n --line-numbers | grep -i fail2ban

Show full iptables rules:

sudo iptables-save | grep "YOUR.HOME.IP.ADDR"

nftables

Many newer Linux distributions use nftables instead of iptables.

sudo nft list ruleset | grep "YOUR.HOME.IP.ADDR"

Show Fail2Ban-related nftables rules:

sudo nft list ruleset | grep -i fail2ban

UFW

sudo ufw status numbered

Delete a UFW rule by number:

sudo ufw delete RULE_NUMBER

Example:

sudo ufw delete 3

firewalld

sudo firewall-cmd --list-all

Check rich rules:

sudo firewall-cmd --list-rich-rules

Remove a rich rule only if you know exactly what you are removing.

18. Why You Should Not Manually Delete Firewall Rules Before Using Fail2Ban

If Fail2Ban created the ban, use Fail2Ban to remove it.

Preferred:

sudo fail2ban-client set sshd unbanip YOUR.HOME.IP.ADDR

Avoid doing this first unless you know what you are doing:

sudo iptables -D ...

Why? Because Fail2Ban manages its own rules. If you remove rules manually, Fail2Ban’s internal state may still think the IP is banned, or it may recreate rules later. The cleaner method is to always use fail2ban-client. ([Server Fault])

19. Recommended Steps When an AI Agent Locks You Out

If Codex, a coding agent, a deployment tool, or another automation keeps getting your IP blocked, follow this checklist.

Step 1: Find your public IP

From your local machine:

curl ifconfig.me

Or:

curl https://api.ipify.org

Copy the result.

Step 2: SSH into the server from another network or console

If your home IP is blocked, use one of these:

• VPS provider web console
• Mobile hotspot
• VPN exit IP
• Another trusted machine
• Cloud provider rescue console

Step 3: Unban your IP everywhere

IP="YOUR.HOME.IP.ADDR"

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  echo "Unbanning $IP from $jail"
  sudo fail2ban-client set "$jail" unbanip "$IP"
done

Step 4: Check why it happened

sudo grep "YOUR.HOME.IP.ADDR" /var/log/fail2ban.log

If it was SSH:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/auth.log

Or:

sudo journalctl -u ssh --since "today" | grep "YOUR.HOME.IP.ADDR"

Step 5: Test SSH manually before reconnecting the AI agent

From your local machine:

ssh -vvv user@your-server-ip

If you use a custom SSH port:

ssh -vvv -p 2222 user@your-server-ip

If you use a specific key:

ssh -vvv -i ~/.ssh/your_key user@your-server-ip

Step 6: Fix the credentials before retrying automation

Check the basics:

whoami
pwd
ls -la ~/.ssh
cat ~/.ssh/config

On the server, check the target user:

id username
sudo ls -la /home/username/.ssh
sudo cat /home/username/.ssh/authorized_keys

Correct SSH permissions:

sudo chmod 700 /home/username/.ssh
sudo chmod 600 /home/username/.ssh/authorized_keys
sudo chown -R username:username /home/username/.ssh

Then test again manually before letting the AI agent retry.

20. Safe Fail2Ban Settings for Automation-Heavy Servers

AI agents and deployment tools may fail several times while being configured. That does not mean you should disable Fail2Ban, but you may want to make your settings more forgiving during setup.

Create a local SSH jail override:

sudo nano /etc/fail2ban/jail.d/sshd.local

Relaxed settings for automation-heavy servers:

[sshd]
enabled = true
maxretry = 6
findtime = 10m
bantime = 30m

Stricter settings for public-facing production servers:

[sshd]
enabled = true
maxretry = 3
findtime = 10m
bantime = 1h

Reload:

sudo fail2ban-client reload sshd

Check:

sudo fail2ban-client status sshd

For repeated attackers, some setups use longer bans or incremental bans, but be careful not to punish yourself during setup and testing.

21. Recommended SSH Config for AI Agents and Deployment Tools

Instead of letting an AI agent guess SSH details, create a clear SSH host entry on your local machine.

Edit:

nano ~/.ssh/config

Add:

Host my-vps
    HostName YOUR.SERVER.IP.ADDR
    User yourusername
    Port 22
    IdentityFile ~/.ssh/your_private_key
    IdentitiesOnly yes

Then test:

ssh my-vps

Once that works, tell the AI agent or deployment tool to use:

ssh my-vps

This reduces repeated failed attempts caused by wrong usernames, wrong keys, or wrong ports.

22. Best Practice: Use a Dedicated Deployment User

Do not let every AI tool or automation system log in as root.

Create a deployment user:

sudo adduser deploy

Add SSH key:

sudo mkdir -p /home/deploy/.ssh
sudo nano /home/deploy/.ssh/authorized_keys

Fix permissions:

sudo chown -R deploy:deploy /home/deploy/.ssh
sudo chmod 700 /home/deploy/.ssh
sudo chmod 600 /home/deploy/.ssh/authorized_keys

Test:

ssh deploy@your-server-ip

If the deployment user needs limited sudo access, use:

sudo visudo

Add only what is necessary. Avoid broad passwordless sudo unless you fully understand the risk.

23. Best Practice: Disable Password SSH Login

Once key-based login works, disable password login to reduce brute-force risk.

Edit SSH config:

sudo nano /etc/ssh/sshd_config

Set:

PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

Test config before restarting:

sudo sshd -t

Restart SSH:

sudo systemctl restart ssh

Critical: Keep an existing SSH session open while testing a new connection so you do not lock yourself out if something is misconfigured.

24. Emergency Script: Unban My IP Everywhere

Save this as:

sudo nano /usr/local/sbin/unban-ip

Paste:

#!/usr/bin/env bash

set -euo pipefail

if [ "${1:-}" = "" ]; then
  echo "Usage: sudo unban-ip <IP_ADDRESS>"
  exit 1
fi

IP="$1"

echo "Checking Fail2Ban status..."
sudo fail2ban-client status >/dev/null

echo "Unbanning $IP from all active Fail2Ban jails..."

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  echo " - $jail"
  sudo fail2ban-client set "$jail" unbanip "$IP" || true
done

echo
echo "Done. Verifying..."
for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  if sudo fail2ban-client status "$jail" | grep -qw "$IP"; then
    echo "Still found in $jail"
  fi
done

echo "Finished."

Make it executable:

sudo chmod +x /usr/local/sbin/unban-ip

Use it:

sudo unban-ip YOUR.HOME.IP.ADDR

25. Emergency Script: Show All Banned IPs

Save this as:

sudo nano /usr/local/sbin/show-banned-ips

Paste:

#!/usr/bin/env bash

set -euo pipefail

echo "Active Fail2Ban jails and banned IPs:"
echo

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  echo "=== $jail ==="
  sudo fail2ban-client status "$jail" | sed -n 's/^.*Banned IP list:[[:space:]]*//p'
  echo
done

Make it executable:

sudo chmod +x /usr/local/sbin/show-banned-ips

Run:

sudo show-banned-ips

26. Emergency Script: Find Which Jail Has a Banned IP

Save this as:

sudo nano /usr/local/sbin/find-banned-ip

Paste:

#!/usr/bin/env bash

set -euo pipefail

if [ "${1:-}" = "" ]; then
  echo "Usage: sudo find-banned-ip <IP_ADDRESS>"
  exit 1
fi

IP="$1"
FOUND=0

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  if sudo fail2ban-client status "$jail" | grep -qw "$IP"; then
    echo "$IP is banned in jail: $jail"
    FOUND=1
  fi
done

if [ "$FOUND" -eq 0 ]; then
  echo "$IP was not found in any active Fail2Ban jail."
fi

Make it executable:

sudo chmod +x /usr/local/sbin/find-banned-ip

Use:

sudo find-banned-ip YOUR.HOME.IP.ADDR

27. Troubleshooting: Fail2Ban Says No Jails Are Running

Run:

sudo fail2ban-client status

If there are no jails, check:

sudo systemctl status fail2ban

Then check config errors:

sudo fail2ban-client -t

Check logs:

sudo journalctl -u fail2ban --since "today"

Or:

sudo tail -100 /var/log/fail2ban.log

Common causes:

• Bad syntax in jail.local
• Wrong log file path in the jail filter
• Missing log file that Fail2Ban expects to read
• Wrong backend (e.g., needing backend = systemd)
• Firewall backend mismatch
• Jail explicitly disabled with enabled = false

28. Troubleshooting: IP Is Still Blocked After Unbanning from Fail2Ban

If you unbanned the IP from Fail2Ban but still cannot connect, check these additional layers.

Check if the IP is still in Fail2Ban

sudo find-banned-ip YOUR.HOME.IP.ADDR

Or manually:

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  sudo fail2ban-client status "$jail" | grep -w "YOUR.HOME.IP.ADDR" && echo "Found in $jail"
done

Check iptables

sudo iptables-save | grep "YOUR.HOME.IP.ADDR"

Check nftables

sudo nft list ruleset | grep "YOUR.HOME.IP.ADDR"

Check UFW

sudo ufw status numbered

Check your VPS provider firewall

Log into your VPS provider dashboard and check:

• Cloud firewall
• Security groups
• Network ACLs
• DDoS protection rules
• IP deny lists

Check whether your IP changed

From your local machine:

curl ifconfig.me

Your home IP may have changed since the ban was placed.

29. ISPConfig 3 Specific Notes

ISPConfig 3 itself can coexist with Fail2Ban, Apache, mail services, FTP, and firewall tools. Depending on how your server was installed, your ISPConfig host may have jails for services such as SSH, Apache, Dovecot, Postfix, Pure-FTPd, and possibly ISPConfig login protection.

A HowtoForge guide also notes that ISPConfig has its own behavior for blocking repeated wrong logins, while Fail2Ban can be used to further tune blocking around ISPConfig login failures. ()

If you are locked out of the ISPConfig panel specifically, check:

sudo fail2ban-client status

Then inspect web and panel-related logs:

sudo grep "YOUR.HOME.IP.ADDR" /var/log/fail2ban.log
sudo grep "YOUR.HOME.IP.ADDR" /var/log/apache2/access.log
sudo grep "YOUR.HOME.IP.ADDR" /var/log/apache2/error.log

Also check whether the ISPConfig panel runs on a custom port, commonly:

8080

If Apache or the firewall blocks that port, the panel may appear inaccessible even if SSH works.

30. Personal Checklist Before Giving AI Agents Server Access

Before giving an AI agent, deployment bot, or coding assistant server access, verify:

[ ] I know the correct SSH username.
[ ] I know the correct SSH port.
[ ] I know which private key is being used.
[ ] The matching public key is in authorized_keys on the server.
[ ] The server allows public key authentication.
[ ] I tested SSH manually before using the agent.
[ ] I created a dedicated deploy user instead of using root.
[ ] I know how to unban my IP if it gets blocked.
[ ] My home IP is whitelisted only if it is static and trusted.
[ ] I have VPS console access in case I lock myself out.

Recommended manual SSH test:

ssh -vvv -i ~/.ssh/your_key youruser@your-server-ip

Recommended agent-safe SSH config:

Host my-vps
    HostName YOUR.SERVER.IP.ADDR
    User deploy
    Port 22
    IdentityFile ~/.ssh/your_private_key
    IdentitiesOnly yes

Test:

ssh my-vps

Only after that works should the agent use the server.

31. The Most Common Fail2Ban Commands (Quick Reference)

Show Fail2Ban jails

sudo fail2ban-client status

Show SSH bans

sudo fail2ban-client status sshd

Unban my IP from SSH

sudo fail2ban-client set sshd unbanip YOUR.HOME.IP.ADDR

Unban my IP from every jail

IP="YOUR.HOME.IP.ADDR"

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  sudo fail2ban-client set "$jail" unbanip "$IP"
done

See why I was banned

sudo grep "YOUR.HOME.IP.ADDR" /var/log/fail2ban.log

Watch SSH failures live

sudo tail -f /var/log/auth.log

Or:

sudo journalctl -u ssh -f

Check firewall rules

sudo iptables-save | grep "YOUR.HOME.IP.ADDR"
sudo nft list ruleset | grep "YOUR.HOME.IP.ADDR"
sudo ufw status numbered

Reload Fail2Ban

sudo fail2ban-client reload

Restart Fail2Ban

sudo systemctl restart fail2ban

32. Final Recommendation

For an ISPConfig 3 VPS running Apache, SSH, mail, FTP, and automation tools, keep Fail2Ban enabled. It protects you from brute-force attacks and noisy bots. But if you use AI agents or automated deployment tools, make sure they are configured carefully before allowing repeated login attempts.

The best setup is:

Fail2Ban enabled
SSH keys configured correctly
Dedicated deploy user
No root login
No password SSH login
Known emergency unban command
VPS console access available
Optional whitelist for stable trusted IPs

When you get blocked, do not panic. Start with:

sudo fail2ban-client status

Then check the relevant jail:

sudo fail2ban-client status sshd

Then unban:

sudo fail2ban-client set sshd unbanip YOUR.HOME.IP.ADDR

And if you are not sure where the IP was banned:

IP="YOUR.HOME.IP.ADDR"

for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do
  sudo fail2ban-client set "$jail" unbanip "$IP"
done

That one command will save you a lot of time.

Frequently Asked Questions

How do I unban my IP from Fail2Ban?

Run sudo fail2ban-client set <jail> unbanip <IP>. If you do not know which jail banned you, loop through all jails using: for jail in $(sudo fail2ban-client status | sed -n 's/^.*Jail list:[[:space:]]*//p' | tr ',' ' '); do sudo fail2ban-client set "$jail" unbanip "YOUR.IP"; done

How do I see all banned IPs on my server?

Run sudo fail2ban-client banned on Fail2Ban 0.11+. On older versions, loop through each jail with sudo fail2ban-client status <jail> and check the “Banned IP list” line.

Why is my IP still blocked after unbanning from Fail2Ban?

The block may exist in iptables, nftables, UFW, firewalld, your VPS provider’s cloud firewall, or Apache/ModSecurity rules. Check each layer. Also verify your public IP has not changed.

How do I whitelist my IP in Fail2Ban?

Add your IP to the ignoreip line in /etc/fail2ban/jail.local under [DEFAULT], then run sudo fail2ban-client reload. Only do this with static, trusted IPs.

How do I stop AI agents from getting my IP banned?

Configure proper SSH keys, use a dedicated deploy user, set up an ~/.ssh/config entry with the correct host, port, user, and key, and test manually before enabling automation. Optionally increase maxretry in the sshd jail.

Where are Fail2Ban logs stored?

The main Fail2Ban log is at /var/log/fail2ban.log. It records all ban and unban events with timestamps, IP addresses, and jail names.

Does ISPConfig 3 have its own IP blocking?

Yes. ISPConfig can block IPs after repeated wrong panel logins independently of Fail2Ban. Check both the Fail2Ban jails and the ISPConfig panel settings if you are locked out of the web interface.