IP Blocked in UFW, yet continue to see failed password attempts in auth.log

Question

sudo ufw deny from 182.100.67.120
sudo service ufw restart

Yet, continuous entries in /var/log/auth.log

Feb 18 03:40:01 service sshd[2729]: Failed password for root from 182.100.67.120 port 51942 ssh2

If the IP is banned in UFW, why it is still getting into ssh login?

Answer 1

I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :

sudo ufw insert 1 deny from 182.100.67.120
sudo service ufw restart

But before this, first I had to delete the deny entry using:

sudo ufw status numbered

Get the serial number of the previously entered deny entry for the above port, then

sudo ufw delete <serial number >