My IP Was Blocked by the Server Firewall: How to Get Unblocked (CSF/LFD and Fail2Ban)

If your website, cPanel, SSH and email all time out from one connection while they work from another, the server firewall has most likely blocked your IP address after repeated failed logins. On shared or cPanel hosting, find your public IP and open a support ticket with that IP and the service you were using, and support will remove the block. On your own VPS, remove it yourself with csf -dr or csf -tr (CSF/LFD), or with fail2ban-client set sshd unbanip (Fail2Ban). Then fix the wrong saved password that caused the block so it does not come back.

This guide covers both cases: Cloudesta shared hosting, where support handles the firewall, and Cloud VPS or dedicated servers, where you have root access.

Prerequisites

• A second internet connection for testing, such as your phone on mobile data with Wi-Fi turned off.
• For shared hosting: access to the Cloudesta client area to open a ticket.
• For a VPS or dedicated server: root or sudo SSH access from an IP that is not blocked.

1. How do I know my IP is blocked by the firewall?

A firewall block affects every service on the server at once, but only from your connection. Typical signs:

• Your website loads forever and ends with a timeout, but opens normally on mobile data.
• cPanel on port 2083, webmail, FTP and SSH all time out from the office or home network.
• Your email client keeps reporting it "cannot connect to the server".
• Colleagues on other networks have no problems.

If the site is down from every network, the cause is something else, such as DNS, an expired domain or a server problem. If you get a password error rather than a timeout, the server is reachable and you are not blocked.

2. Why does the server block my IP?

Servers on the internet receive constant password-guessing attacks. To stop them, security software watches the logs and blocks any IP that fails to log in too many times in a short period:

• Shared and cPanel servers: LFD (Login Failure Daemon) watches SSH, cPanel, webmail, IMAP/POP3, SMTP and FTP logins and tells CSF (ConfigServer Security & Firewall) to block the IP. cPanel's cPHulk and Imunify360 can also block repeated failed logins.
• Plain Ubuntu VPS: Fail2Ban usually does the same job, most often through its sshd jail.

The firewall cannot tell an attacker from a phone that keeps retrying an old password. A changed email password that was not updated on every device is the most common cause.

3. How do I find my public IP address?

The server sees your public IP, not your computer's local address such as 192.168.1.20. From the blocked network, open a "what is my IP" website in a browser, or run this in a terminal on Linux, macOS or Windows 10/11:

curl -4 ifconfig.me
curl -6 ifconfig.me

Write down both results if you have IPv6, because either one can be blocked. Run the command with any VPN switched off unless you normally connect through the VPN.

4. How do I get unblocked on shared or cPanel hosting?

On shared hosting you cannot change the server firewall yourself. Some hosting providers add an "Unblock IP" tool to cPanel. If you see one in your cPanel account, enter your IP there. Otherwise, from a working connection such as mobile data, open a support ticket and include:

• Your public IP address from step 3.
• Your domain name, for example example.com.
• What you were doing when it happened, for example "Outlook on my laptop", "FTP upload with FileZilla" or "logging into cPanel".

Support will remove the block and can tell you which login triggered it. That information is what you need to stop it happening again.

5. How do I unblock an IP in CSF on my own server?

Connect over SSH from a different IP (mobile hotspot, another office or another server). On a cPanel server you can also use WHM » Plugins » ConfigServer Security & Firewall, which offers the same actions. First, check whether and why the IP is blocked:

sudo csf -g 203.0.113.10

The output shows any matching firewall rule and the line in /etc/csf/csf.deny or the temporary list, usually with a reason such as (imapd) Failed IMAP login. Remove a permanent block with:

sudo csf -dr 203.0.113.10

Remove a temporary block with:

sudo csf -tr 203.0.113.10

To see the history of blocks for that IP in the LFD log, run:

sudo grep 203.0.113.10 /var/log/lfd.log

6. How do I unban an IP in Fail2Ban on Ubuntu?

List the active jails, then check the SSH jail:

sudo fail2ban-client status
sudo fail2ban-client status sshd

If your IP appears under "Banned IP list", remove it from that jail:

sudo fail2ban-client set sshd unbanip 203.0.113.10

If you are not sure which jail banned you, this command removes the IP from all jails at once:

sudo fail2ban-client unban 203.0.113.10

7. How do I stop my IP from being blocked again?

• Update saved passwords everywhere. After changing an email password, update it on every phone, tablet, laptop and mail app that uses that account. If you cannot find the device, remove the account from it entirely. If your mail setup is getting hard to manage, Cloudesta business email keeps mail separate from your web hosting server.
• Use SSH keys instead of passwords on your VPS, so mistyped passwords no longer count as failed logins.
• Whitelist a static office IP. On shared hosting, request this in a ticket. On your own CSF server, run the commands below:

sudo csf -a 203.0.113.10 "Office static IP"
echo "203.0.113.10" | sudo tee -a /etc/csf/csf.ignore
sudo csf -r
sudo systemctl restart lfd

For Fail2Ban, create or edit /etc/fail2ban/jail.local:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.10

sudo systemctl restart fail2ban

Only whitelist IPs that are static and that you control. A whitelisted IP is never blocked, even if someone on that network starts guessing passwords.

Verify it works

On the server, confirm that the IP no longer appears in the firewall or ban lists:

sudo csf -g 203.0.113.10
sudo fail2ban-client status sshd

From the previously blocked network, test the connection to the server:

curl -I https://example.com
nc -zv example.com 22

A response header from curl and "succeeded" from nc mean the block is gone. Then open your email client and confirm it can send and receive.

Common problems

The block comes back every day

Some device is still trying an old password. Check every phone, tablet, second laptop and shared office PC for a mail account using that address, and update or remove it. On your own server, run grep on /var/log/lfd.log or /var/log/fail2ban.log to see which service is failing.

Whitelisting stopped working

Most home and mobile connections use dynamic IPs that change after a router restart, so the whitelisted address is no longer yours. Ask your ISP for a static IP, or rely on SSH keys and correct passwords instead of a whitelist.

Blocked only when using a VPN

The server sees the VPN exit IP, not your office IP. Other users of the same VPN may also have triggered the block. Run step 3 with the VPN switched on, unblock that IP, or switch the VPN off when you manage the server.

Unblocked but still timing out

You may have unblocked the IPv4 address while you are connecting over IPv6, or the reverse. Another layer, such as cPHulk, Imunify360 or a second Fail2Ban jail like recidive, may also still be blocking you. Check both IP versions and every jail. On shared hosting, tell support that the problem continues after the unblock.

Frequently asked questions

How long does a firewall block last?

It depends on the server configuration. Fail2Ban on Ubuntu bans for 10 minutes by default, while CSF can apply temporary blocks or permanent ones that stay until someone removes them.

Are my website visitors blocked too?

No. Only the specific IP that failed the logins is blocked, so visitors on other connections can still reach your site and email.

Can I manage the firewall myself instead of opening tickets?

On shared hosting, the firewall is managed by support. On a Cloud VPS or dedicated server, you have root access and can run every command in this guide yourself.

Need help? Open a ticket at https://cloudesta.com/submitticket.php with your public IP, your domain or server IP, and the service you were using when the block happened.