When Fail2Ban blocks an IP, it creates iptables rules that remain persistent even if the service isn't restarted. In your case, the IP 89.31.259.161 appears twice in the fail2ban-httpd chain. This duplication can occur when:

• Multiple jails are monitoring the same service
• The IP triggered multiple ban conditions
• The ban time hasn't expired yet

The command you used was correct, but needs to be repeated for each rule. Here's the complete solution:

# First, list all rules with line numbers
iptables -L fail2ban-httpd --line-numbers

# Then delete each rule by its number
iptables -D fail2ban-httpd 1
iptables -D fail2ban-httpd 2

For more permanent removal, consider these approaches:

Using Fail2Ban Client

fail2ban-client set [jail-name] unbanip 89.31.259.161

Replace [jail-name] with your actual jail (e.g., apache, sshd)

Editing Fail2Ban Database

The banned IPs are stored in:

/var/lib/fail2ban/fail2ban.sqlite3

You can query and modify it with:

sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 "DELETE FROM bans WHERE ip = '89.31.259.161';"

Add this to your jail.local configuration:

[Definition]
# Prevent multiple bans of same IP
ignoreip = 89.31.259.161

After unblocking, verify with:

iptables -L fail2ban-httpd -n | grep 89.31.259.161
fail2ban-client status [jail-name]

For bulk operations, use this script:

#!/bin/bash
IP_TO_UNBLOCK="89.31.259.161"
JAILS=$(fail2ban-client status | grep "Jail list" | sed 's/^.*: //g' | tr ',' '\n')

for JAIL in $JAILS
do
  fail2ban-client set $JAIL unbanip $IP_TO_UNBLOCK
done

When examining your iptables output, we can see two identical DROP rules for IP 89.31.259.161 in the fail2ban-httpd chain. This explains why running iptables -D only removed one instance - you need to execute the command twice for complete removal.

There are three professional approaches to unblock an IP without service restart:

# Method 1: Using iptables directly (as you did)
iptables -D fail2ban-httpd -s 89.31.259.161 -j DROP
# Run twice if multiple identical rules exist

# Method 2: Using fail2ban-client (recommended)
fail2ban-client set httpd unbanip 89.31.259.161

# Method 3: Removing from fail2ban's database
fail2ban-client set httpd delignoreip 89.31.259.161

The iptables method provides immediate but temporary relief - the IP may get banned again if Fail2Ban detects new violations. For permanent unblocking:

# Add to jail.local configuration
[DEFAULT]
ignoreip = 127.0.0.1/8 89.31.259.161

# Then reload fail2ban
systemctl reload fail2ban

For cases with duplicate rules, this script helps:

#!/bin/bash
IP_TO_UNBLOCK="89.31.259.161"
CHAIN_NAME="fail2ban-httpd"

while iptables -D $CHAIN_NAME -s $IP_TO_UNBLOCK -j DROP 2>/dev/null; do
    echo "Removed one rule for $IP_TO_UNBLOCK"
done

Always verify with these commands:

iptables -L -n | grep $IP_TO_UNBLOCK
fail2ban-client status httpd | grep Banned