Fail2ban ignoreip is a default feature to whitelist trusted IPs.

Usually, fail2ban bans IPs that are suspicious while monitoring logs.

But if the user wants to whitelist a trusted IP, we edit ignoreip in the conf file.

At Bobcares, we use fail2ban to whitelist IPs, as a part of our Server Management Services.

Today, we will discuss how to whitelist IP in fail2ban and see how our Support Engineers do this.

What is fail2ban ignoreip?

Password protected remote services often face brute force attacks, dictionary attacks, etc. Here is where the fail2ban comes to rescue.

Fail2ban is a software tool to prevent attacks on a server. This software framework allows users to customize their requirements.

Fail2ban monitors the server logs for any suspicious activities. And if it finds one, it takes necessary actions.

For instance, an ssh login failure a few times in a short duration of time. Fail2ban considers this as an attack and ban the particular IP from logging in.

But this doesn’t insist to ban all IPs. Users can whitelist or unban trusted IPs forever.

So, there is a default feature in fail2ban, ignoreip. This feature whitelists IPs.

How to whitelist IP in fail2ban using ignoreip?

The default config file of fail2ban is etc/fail2ban/jail.conf. But our Support Engineers do not recommend editing this file. Because this file can reset to default on upgrading. And our custom changes may be lost.

So, whenever our customers need to whitelist a particular IP, we edit the local conf file. That is, the /etc/fail2ban/jail.local file.

Firstly, we check for the default entry and edit the same. By default, there will be a localhost entry. In addition, we can add IPs and IP ranges each separated by a white-space.

The default ignoreip entry in jail.local appears as,

Here we uncomment the ignoreip entry. Here we add the trusted IPs.

ignoreip = 10x.21x.2xx.2xx 10x.21x.2xx.1xx/16

Later, we save and quit the config file. Finally, we restart the fail2ban service in the server.

service fail2ban restart

If users need separate config files for each setting, this is also possible. In /etc/fail2ban/jail.d we can add as many files as needed with .conf extension. This sets custom config files for each setting we need.

[Need assistance in fail2ban IP whitelisting? – We are available 24/7.]

Conclusion

In short, fail2ban automatically bans IPs that try to attack the server. Fail2ban ignoreip is a default feature to whitelist trusted IP forever. Today, we saw how our Support Engineers do this in the config settings.