What to Do If Your IP Address Is Blocked by an ISPConfig Server

This guide explains what to do if the server that hosts your Noiz services suddenly stops responding for you, while it keeps working normally for everyone else. The usual cause is an automatic security block, sometimes called an IP ban, a firewall block or a fail2ban block, placed on your internet connection's IP address after repeated failed logins. It is written for Noiz clients whose hosting runs on an ISPConfig server. You will learn how to recognise a block, how to confirm it, how to find the IP address that Noiz support needs in order to unblock you, and how to stop the block from coming back.

Last reviewed: 27 July 2026, against ISPConfig 3.3.1p1. This guide is written for Noiz hosting and is kept current against ISPConfig. It complements, and does not replace, the official ISPConfig documentation linked below.

Official Documentation Reference

• ISPConfig 3 User Manual: the official manual; fail2ban blocking is covered in section 4.10.5.10 (Show fail2ban-Log) and section 5.16 (How Do I Unblock An IP Address That Got Blocked By fail2ban?).
• Fail2ban project page: the official page of the security tool that performs the blocking, describing how it scans logs and bans IP addresses that make too many failed login attempts.
• HowtoForge forum: how to manually unban an IP blocked by fail2ban: community reference confirming that removing a block requires administrator access to the server, which is why Noiz support handles it for you.

Prerequisites

• You know how to log in to the ISPConfig control panel. During a block the panel may not load for you at all; knowing what the login page normally looks like helps you confirm that.
• Access to a second internet connection for testing, most easily a mobile phone with Wi-Fi switched off so it uses mobile data.
• No technical knowledge is required. You will not need to run any commands; the unblocking itself is done by Noiz support.

Why a Server Blocks Your IP Address

ISPConfig servers run a security tool called fail2ban. It watches the server's log files for login attempts to services such as email (IMAP, POP3 and SMTP), FTP, SSH and the web server. If it sees repeated failed logins from the same IP address within a short time, it treats them as a possible break-in attempt and tells the server firewall to stop accepting connections from that address. The block is automatic, applies day and night, and does not distinguish between a genuine attacker and a legitimate client whose device keeps sending an old password.

That last point is the most common real-world cause. Typical triggers include:

• A phone, tablet or computer with an email account still saved under an old password, silently retrying every few minutes after you changed the mailbox password.
• An FTP program or backup tool with outdated saved credentials that reconnects automatically.
• Someone in your home or office repeatedly mistyping a password.
• A genuine attacker guessing passwords from your network, for example malware on a computer that shares your connection.

The ISPConfig control panel is a special case. It guards its own login page separately, counting failed attempts per IP address rather than adding a firewall rule, so a panel lockout and a firewall block look quite different on screen. The section below shows how to tell them apart.

Two important consequences follow from how the block works:

• The whole connection is blocked, not just one device. Everyone sharing your internet connection, such as an entire office or household, is affected at the same time, because they all share one public IP address.
• Only your connection is blocked. Your website stays online and your email keeps flowing for the rest of the world. Visitors, customers and colleagues on other connections notice nothing. A block is inconvenient, but it is not an outage.

Blocks are normally temporary and expire on their own after a set period, but if the underlying cause is still active, for example a device still retrying a wrong password, the block simply comes back.

How to Recognise an IP Block

A firewall block silently discards your connection attempts, so the tell-tale sign is timeouts rather than error messages. Depending on which service triggered the block, one service or several may be affected. Typical symptoms:

• Your website will not load from your location and the browser eventually shows a message like connection timed out, while the same site loads fine on mobile data.
• Your email program reports that it cannot connect to the server, or messages sit in the outbox, on every device in the office at once.
• Your FTP program hangs on connecting and then times out.
• The ISPConfig control panel login page will not load at all.

Just as useful are the signs that it is not an IP block:

• The site loads but shows an error page, such as a 404, 500 or a database error. The server answered you, so you are not blocked; that is a website problem.
• You reach the login screen but your password is rejected. The server answered you; that is a credentials problem, although repeated wrong attempts can turn it into a block, so stop retrying and reset the password instead.
• The ISPConfig login page loads but reports Too many failed login attempts. Please retry after 15 minutes. That is the panel's own protection rather than a firewall block: ISPConfig counts failed logins per IP address and stops accepting them after more than five in quick succession. Nothing needs unblocking, and the count clears once a login succeeds, so stop retrying and make sure you have the correct password before trying again.
• The service is also unreachable from mobile data and other connections. That points to a wider problem rather than a block on your address.

Step 1: Confirm the Block from a Second Connection

1. Take a mobile phone and switch Wi-Fi off, so that it connects over mobile data. Mobile data uses a different public IP address from your fibre, DSL or office connection.
2. In the phone's browser, open your website, for example https://yourdomain.com, and if you use it, the ISPConfig panel address.
3. Compare the results:
   • Works on mobile data, times out on your normal connection: this strongly suggests your connection's IP address is blocked. Continue to Step 2.
   • Fails on both: this is probably not an IP block. Skip to the Troubleshooting section below.

If you do not have mobile data available, asking a friend or colleague on a different connection to try the site gives you the same comparison.

Step 2: Find Your Public IP Address

To remove a block, Noiz support needs the public IP address of the affected connection. This is the address your whole network presents to the internet; it is not the internal address of your computer, which usually starts with 192.168. or 10..

1. On a device connected to the affected connection (not on mobile data), open a browser.
2. Search the web for what is my IP. Most search engines display your public IP address at the top of the results, and many websites offer the same lookup.
3. Note the address exactly as shown. An IPv4 address looks like 198.51.100.24 (an example value); you may also see a much longer IPv6 address containing colons. Copy whatever is displayed.

Two things worth knowing about public IP addresses in South Africa: many home fibre and LTE connections use dynamic addresses that change from time to time, and some mobile and LTE providers share one public address between many customers. This is why the lookup must be done from the affected connection at the time of the problem; an address you noted last month may no longer be yours.

Step 3: Contact Noiz Support to Remove the Block

Removing a fail2ban block requires administrator access to the server's firewall, so it is not something you can do from the ISPConfig panel or from your own account. Open a support ticket with the Noiz support team and include:

• Your public IP address from Step 2, for example 198.51.100.24.
• Your domain name, for example yourdomain.com.
• Which services are failing for you: website, email, FTP or the panel.
• Roughly when the problem started.
• Anything that changed shortly before, such as a password change on a mailbox or FTP account. This helps support identify the cause as well as lift the block.

If your usual route to support runs through the blocked server, submit the ticket from a device on mobile data instead. Support can confirm from the server's fail2ban log which service triggered the block and remove it. That log view shows only the most recent activity, so reporting the problem promptly makes the triggering service far easier to pin down.

Because blocks are temporary by default, you may find that access returns by itself after a while. Do not treat that as the end of the matter: if a device is still sending wrong credentials, the next block is only minutes away. Move straight on to Step 4.

Step 4: Stop the Block from Coming Back

A repeat block almost always means something on your network is still retrying a wrong password. Track it down before it triggers fail2ban again.

Check every device with a saved email password

1. List every phone, tablet and computer that has the affected email account set up, including old devices in a drawer that are still switched on and connected to Wi-Fi.
2. If a mailbox password was changed recently, update the saved password in the email app on every one of those devices. One forgotten phone is enough to keep triggering blocks.
3. Remove email accounts that are no longer used from old devices entirely.

Check FTP programs, backup tools and scripts

1. Open any FTP program you use and check the saved credentials for your site. Update or delete entries that hold old passwords.
2. Think about anything automated: backup utilities, deployment scripts, website plugins that connect over FTP or SMTP. Automated tools retry far faster than a human and can trigger a block within minutes.

Adopt habits that avoid future blocks

• When you change any hosting password, change it everywhere it is saved in the same sitting.
• If a login is rejected more than twice, stop and reset the password rather than guessing repeatedly.
• Use a password manager so each device uses the current, correct password.
• Run up-to-date antivirus checks if blocks recur with no obvious cause, since malware on one computer can attack the server from your connection without your knowledge.

Troubleshooting

• Access came back on its own after a short while: the temporary ban expired. The cause is still out there, so work through Step 4, otherwise the cycle repeats.
• You get blocked again soon after support unblocks you: a device or program on your network is still using wrong credentials. Switch off suspect devices one at a time, or temporarily disable the email account on each device, to isolate the culprit, then correct its saved password.
• Only email fails, the website loads fine: a block can cover only the service that triggered it. It is still the same problem; include this detail in your ticket because it tells support which log to check.
• The site is down on mobile data too: this is not an IP block on your address. Check for a domain or server-wide issue and contact Noiz support describing what you see.
• The site loads but shows an error page: the server is answering you, so you are not blocked. Troubleshoot the website itself instead.
• Your public IP address keeps changing: dynamic addresses are normal on many South African connections. Always look the address up at the moment of the problem, from the affected connection, and send support the current value.

If you get stuck at any point, open a support ticket with the Noiz support team and include your public IP address, your domain name, which services are failing, when the problem started and whether any passwords were changed recently. Never include the passwords themselves in the ticket.