# Moderators can IP ban Admins
**URL:** https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204
**Category:** Feature
**Created:** [July 12, 2018, 7:51pm UTC](https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204 "2018-07-12T19:51:49Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Karl\_Romanowski](https://meta.discourse.org/u/Karl_Romanowski)
#### Post date: [July 12, 2018, 7:51pm UTC](https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204/1 "2018-07-12T19:51:49Z")
Moderators have access to the Screened IPs admin area and can block the IP address of an Admin, preventing admin login. The admin sees “There is a problem with your account. …”
Expected: Moderators should either not have access to edit Screened IPs, or Admin account logins should not be blocked by Screened IPs.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [July 13, 2018, 12:20am UTC](https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204/2 "2018-07-13T00:20:26Z")
Or.. maybe admins should be l33t enough to use a VPN to get back in?!?! 🤪
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [July 13, 2018, 1:15am UTC](https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204/3 "2018-07-13T01:15:05Z")
I was thinking about how this _might_ have happened, I’m assuming it was not intentional.
Admin has IP Screened IPs as “allow”
Moderator / System identifies a bad actor using the same IP, Admin IP gets netted in a roll-up
AFAIK, the Screened IPs that have “allow” take precedence over “block”. I may be wrong about this, but I really don’t think so. (I’ll poke around in some code)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 13, 2018, 1:34am UTC](https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204/4 "2018-07-13T01:34:18Z")
This is such an edge case I am not super enthused about prioritizing, especially since admins usually have 2 devices and can just switch to Phone if they messed stuff up. Or even just SSH in and fix via console.
You are describing a security _hole_ where a moderator goes rogue and blocks admins, however they do not escalate privileges just make life a bit more annoying for admins.
Giving admins a free pass around screened ips is not going to happen.
- I am sort of open to having a sanity test that makes sure you do not block yourself when blocking an IP
- I am open to possibly making an extra sanity test that makes sure no **staff** have the IP to the best of our knowledge prior to adding an IP or range.
Moving this to feature request, I do not see this as a bug.
---
### Author:  [@Karl\_Romanowski](https://meta.discourse.org/u/Karl_Romanowski)
#### Post date: [July 13, 2018, 3:28am UTC](https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204/5 "2018-07-13T03:28:38Z")
Sounds good. I should have just worded my post as a question: If all admins get IP banned, say every IP in the city/area, what’s the easiest way to undo that.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 13, 2018, 3:34am UTC](https://meta.discourse.org/t/moderators-can-ip-ban-admins/92204/6 "2018-07-13T03:34:24Z")
> [@Karl\_Romanowski](#):
>
> what’s the easiest way to undo that.
```plaintext
./launcher enter app
rails c
% ScreenedIpAddress.where("ip_address >>= inet '100.1.0.1'").destroy_all
```
replace `100.1.0.1` with whatever IP