Guide To Removing An IP From The Blacklist In Directadmin

If you cannot access the DirectAdmin control panel after entering an incorrect username or password several times, your IP address may have been temporarily blocked by DirectAdmin’s Brute Force Monitor.

This guide explains how to confirm whether your IP is blacklisted, safely remove only the affected IP, add a trusted address to the whitelist, and troubleshoot other firewall systems that may continue blocking access.

Important: The following steps require SSH access with root privileges. If you use shared hosting or do not manage the server yourself, contact your hosting provider instead of running these commands.

Why Does DirectAdmin Block an IP Address?

DirectAdmin includes a Brute Force Monitor that can detect repeated failed login attempts and temporarily block the source IP address.

An IP may be blacklisted because of:

Repeatedly entering an incorrect DirectAdmin username or password.
A browser or password manager continuously submitting outdated credentials.
Automated requests to the DirectAdmin login page.
Failed login attempts against email, FTP, SSH, or other monitored services.
A compromised device attempting to authenticate in the background.
Several users sharing the same public IP address.
An excessively low brute-force detection threshold.

DirectAdmin normally uses port 2222 for its control-panel interface. A standard secure login address may look like:

https://server-hostname.example.com:2222

Avoid using an unsecured HTTP login address when HTTPS is available.

Before Removing the IP: Identify Which System Blocked It

A DirectAdmin server may use several independent security layers. Removing an address from one blacklist will not restore access if another service is still blocking it.

The IP may be blocked by:

DirectAdmin’s internal login blacklist.
DirectAdmin Brute Force Monitor firewall scripts.
ConfigServer Security & Firewall and Login Failure Daemon.
Fail2Ban.
The server’s operating-system firewall.
A cloud firewall or hosting-provider firewall.
A CDN or web application firewall.

Start by finding your current public IP address. VietSEO customers can check it at:

https://vietseo.com/myip.php

Copy the address exactly. Depending on your network, it may be an IPv4 address such as:

203.0.113.25

or an IPv6 address such as:

2001:db8:1234:5678::25

How to Remove One IP from the DirectAdmin Blacklist

Step 1: Connect to the Server Through SSH

Connect to your VPS or dedicated server using an SSH client such as PuTTY, Windows Terminal, Terminal on macOS, or another SSH application.

A typical SSH command is:

ssh root@server-ip-address

If your server uses a custom SSH port, specify it with -p:

ssh -p 22022 root@server-ip-address

Replace the example server address and port with your actual server information.

Step 2: Back Up the Blacklist File

Before modifying the blacklist, create a backup:

cp /usr/local/directadmin/data/admin/ip_blacklist 
/usr/local/directadmin/data/admin/ip_blacklist.backup

This allows you to restore the original file if necessary.

Step 3: Check Whether Your IP Is Blacklisted

To display the complete DirectAdmin IP blacklist, run:

cat /usr/local/directadmin/data/admin/ip_blacklist

For a long list, search for one specific address instead:

grep -Fx "YOUR_IP_ADDRESS" 
/usr/local/directadmin/data/admin/ip_blacklist

Replace YOUR_IP_ADDRESS with your actual public IP:

grep -Fx "203.0.113.25" 
/usr/local/directadmin/data/admin/ip_blacklist

If the command returns the address, it is present in DirectAdmin’s internal blacklist.

Step 4: Remove Only the Affected IP

Set the affected address as a variable:

IP="203.0.113.25"

Then remove only the exact matching line:

grep -vxF "$IP" 
/usr/local/directadmin/data/admin/ip_blacklist 
> /tmp/directadmin-ip-blacklist.new || true

cat /tmp/directadmin-ip-blacklist.new 
> /usr/local/directadmin/data/admin/ip_blacklist

rm -f /tmp/directadmin-ip-blacklist.new

Confirm that the address has been removed:

grep -Fx "$IP" 
/usr/local/directadmin/data/admin/ip_blacklist

If the command returns no result, the IP is no longer in that file.

Do not empty the entire blacklist unless you have a specific reason.

The following command removes every IP from DirectAdmin’s internal blacklist:

echo "" > /usr/local/directadmin/data/admin/ip_blacklist

Although it may restore your access, it can also unblock malicious addresses previously detected by the server. Removing only the affected IP is safer.

Step 5: Add a Trusted IP to the DirectAdmin Whitelist

If the address belongs to a trusted office, administrator, or secure management connection, add it to the DirectAdmin whitelist:

IP="203.0.113.25"

touch /usr/local/directadmin/data/admin/ip_whitelist

grep -qxF "$IP" 
/usr/local/directadmin/data/admin/ip_whitelist 
|| echo "$IP" 
>> /usr/local/directadmin/data/admin/ip_whitelist

This command first checks the file so the same IP is not added repeatedly.

Confirm the whitelist entry:

grep -Fx "$IP" 
/usr/local/directadmin/data/admin/ip_whitelist

Security warning: Only whitelist IP addresses that you trust and control. Do not whitelist public VPN gateways, shared networks, temporary mobile IPs, or unknown customer addresses.

Step 6: Test DirectAdmin Access

Open DirectAdmin again using its secure hostname and port:

https://server-hostname.example.com:2222

If the page still does not load:

Open it in a private browser window.
Clear saved DirectAdmin credentials from your password manager.
Confirm that your public IP has not changed.
Check whether a second firewall has blocked the address.
Check whether port 2222 is accessible.

Editing the blacklist and whitelist files normally does not require a full server reboot.

Optional: Restart the DirectAdmin Service

If DirectAdmin is running but behaves unexpectedly after you make the change, check its status:

systemctl status directadmin

You can restart only the DirectAdmin service when necessary:

systemctl restart directadmin

Then check its status again:

systemctl status directadmin --no-pager

Do not restart the entire VPS merely to remove one address from a blacklist.

How to Unblock an IP from CSF and LFD

Many DirectAdmin servers also use ConfigServer Security & Firewall. In this case, removing an IP from DirectAdmin’s file may not be sufficient because CSF or Login Failure Daemon can maintain a separate block.

Check Whether CSF Blocked the IP

csf -g 203.0.113.25

This searches CSF rules and related files for the address.

Remove a Permanent CSF Block

csf -dr 203.0.113.25

Remove a Temporary CSF Block

csf -tr 203.0.113.25

Allow the IP in CSF

csf -a 203.0.113.25 "Trusted administrator IP"

Be careful when adding an address to csf.allow. An allowed IP may bypass certain firewall restrictions, so this should be reserved for trusted static management addresses.

Prevent LFD from Blocking the IP

Allowing an IP in CSF and telling LFD to ignore it are not always the same operation. To prevent Login Failure Daemon from blocking a trusted address, add it to:

/etc/csf/csf.ignore

For example:

echo "203.0.113.25 # Trusted administrator IP" 
>> /etc/csf/csf.ignore

csf -r

Only add an IP after confirming that it belongs to a trusted administrator and is unlikely to be reassigned.

How to Check Fail2Ban

Some servers use Fail2Ban instead of, or in addition to, CSF and DirectAdmin’s security tools.

Check whether Fail2Ban is running:

systemctl status fail2ban

Display active jails:

fail2ban-client status

Check a specific jail:

fail2ban-client status JAIL_NAME

Remove an IP from that jail:

fail2ban-client set JAIL_NAME unbanip 203.0.113.25

Replace JAIL_NAME with the actual jail reported by your server.

How to Check Whether DirectAdmin Is Running

If nobody can open the control panel, the problem may not be an IP blacklist. The DirectAdmin service itself may be stopped or unavailable.

Check the service:

systemctl status directadmin

Check whether the server is listening on port 2222:

ss -lntp | grep :2222

Test the service locally from the server:

curl -kI https://127.0.0.1:2222

If DirectAdmin works locally but not from your computer, investigate:

The server firewall.
The hosting provider’s cloud firewall.
Network routing.
A blocked public IP.
Port restrictions imposed by your internet provider.

How to Check DirectAdmin Logs

Logs can help identify whether the problem is caused by incorrect credentials, repeated login attempts, service failure, or another server-level issue.

Review recent DirectAdmin service messages:

journalctl -u directadmin --since "30 minutes ago" 
--no-pager

Follow new log messages in real time:

journalctl -u directadmin -f

You can also inspect DirectAdmin’s log directory:

ls -lah /var/log/directadmin/

Do not publicly share logs without reviewing them first. Log files may contain usernames, IP addresses, file paths, hostnames, and other sensitive server information.

How to Restore the Original Blacklist

If you created the recommended backup and need to restore it, run:

cp /usr/local/directadmin/data/admin/ip_blacklist.backup 
/usr/local/directadmin/data/admin/ip_blacklist

Review the restored file:

cat /usr/local/directadmin/data/admin/ip_blacklist

How to Prevent Future DirectAdmin Lockouts

Use a Password Manager

A password manager reduces repeated typing errors and helps prevent browsers or applications from submitting outdated credentials.

Enable Two-Factor Authentication

Two-factor authentication provides an additional layer of protection when an account password is exposed.

Use a Secure Hostname and HTTPS

Access DirectAdmin through a hostname with a valid TLS certificate:

https://server.example.com:2222

Avoid submitting administrator credentials over an unencrypted HTTP connection.

Avoid Whitelisting Dynamic Addresses

Home, mobile, and some office internet connections use dynamic public IP addresses. When the address changes, the old whitelist entry may later be assigned to another customer of the internet provider.

For safer remote administration, consider:

A trusted static office IP.
A private VPN with a stable exit address.
Restricted firewall access through an administrative network.

Review the Brute-Force Threshold

A threshold that is too low can cause false positives and lock out legitimate administrators. A threshold that is too high reduces protection against automated attacks.

Review the configuration in DirectAdmin under:

Admin Level → Admin Settings → Security Settings

Adjust the setting according to your server’s risk level, number of administrators, and login activity. Do not disable brute-force protection merely to avoid occasional lockouts.

Remove Unused Accounts

Delete or disable former employee, contractor, reseller, and test accounts. Every active account creates another possible authentication target.

Keep DirectAdmin and the Operating System Updated

Install supported DirectAdmin, operating-system, and security-package updates. Before major upgrades, maintain current backups and test critical websites and services.

DirectAdmin Blacklist vs. Email Blacklist

These are two different problems.

A DirectAdmin login blacklist blocks an IP from accessing the server or control panel. An email blacklist, also known as a DNS-based blocklist, may affect whether email sent from your server reaches recipients.

Removing an administrator’s IP from:

/usr/local/directadmin/data/admin/ip_blacklist

does not remove your mail-server IP from Spamhaus, SpamCop, Barracuda, or another external email blocklist.

If your problem involves email delivery, investigate:

The outbound mail-server IP reputation.
PTR or reverse DNS.
SPF.
DKIM.
DMARC.
Compromised mailboxes.
Spam scripts or infected websites.
Mail-server logs and outbound queues.

Common Mistakes to Avoid

Deleting the entire blacklist instead of one IP.
Whitelisting an unknown or shared IP.
Assuming every access problem is caused by DirectAdmin.
Ignoring CSF, LFD, Fail2Ban, or cloud-firewall rules.
Restarting the entire server unnecessarily.
Disabling brute-force protection permanently.
Using HTTP instead of HTTPS for administrator login.
Running commands as root without creating a backup.
Publishing real server IPs, passwords, or logs in public support requests.

Quick DirectAdmin IP Unblock Checklist

Find your current public IPv4 or IPv6 address.
Connect to the server through SSH as root.
Back up the DirectAdmin blacklist.
Search the blacklist for the exact IP.
Remove only that address.
Add it to the whitelist only when it is trusted and stable.
Check CSF, LFD, or Fail2Ban if access remains blocked.
Confirm that DirectAdmin is listening on port 2222.
Review logs if the problem continues.
Correct the cause of repeated failed authentication.

Frequently Asked Questions

Where Is the DirectAdmin IP Blacklist File?

The standard DirectAdmin internal blacklist file is:

/usr/local/directadmin/data/admin/ip_blacklist

Where Is the DirectAdmin IP Whitelist File?

The standard whitelist file is:

/usr/local/directadmin/data/admin/ip_whitelist

Can I Remove a Blacklisted IP Without SSH?

Possibly. An administrator who can still access DirectAdmin from another trusted IP may be able to manage security settings through the control panel. If all administrative access is blocked, SSH, a hosting-provider console, or assistance from the provider may be required.

Do I Need to Restart DirectAdmin After Removing an IP?

A complete server reboot is normally unnecessary. Test access after updating the files. Restart only the DirectAdmin service if it is unresponsive or the updated state is not being applied as expected.

Why Am I Still Blocked After Removing the IP?

The address may also be blocked by CSF, LFD, Fail2Ban, the operating-system firewall, a cloud firewall, or another security layer. Your public IP may also have changed since the original block occurred.

Is It Safe to Clear the Whole Blacklist?

It is generally safer to remove only the exact address that was blocked incorrectly. Clearing the entire file may restore access for malicious IPs that DirectAdmin previously detected.

Should I Whitelist My Home IP?

Only when it is trusted and preferably static. A dynamic residential IP can change and may later be assigned to someone else.

Why Does DirectAdmin Keep Blocking Me?

Common causes include a saved incorrect password, background applications attempting to log in, mail clients using outdated credentials, shared public IP addresses, or an overly aggressive brute-force threshold. Review the relevant logs before repeatedly removing the block.

What Port Does DirectAdmin Use?

DirectAdmin commonly uses TCP port 2222. The port must be reachable through both the server firewall and any external cloud firewall.

Is DirectAdmin Free?

DirectAdmin is commercial software that requires a valid licence. Some hosting providers include the licence in a VPS or hosting package, while other providers charge for it separately.

Conclusion

When an administrator’s IP is blocked, the safest solution is to identify the security layer responsible and remove only the affected address.

For DirectAdmin’s internal login blacklist, the recommended process is to:

Back up the blacklist file.
Confirm that the exact IP is present.
Remove only that IP.
Whitelist it only when it is trusted and stable.
Check CSF, LFD, Fail2Ban, and external firewalls if the block remains.
Investigate the failed login attempts that caused the incident.

Do not disable brute-force protection or clear all security lists as a permanent solution. Correct configuration, strong credentials, two-factor authentication, secure HTTPS access, and regular log monitoring provide a safer long-term approach.

VietSEO provides DirectAdmin licence and server support services, including installation, security configuration, troubleshooting, migration, backup planning, performance optimization, and ongoing VPS administration.