sudo ufw deny from
sudo service ufw restart

Yet, continuous entries in /var/log/auth.log

Feb 18 03:40:01 service sshd[2729]: Failed password for root from port 51942 ssh2

If the IP is banned in UFW, why it is still getting into ssh login?

  • Try " sudo ufw status verbose " and past the output
    – Aravind
    Feb 18, 2018 at 9:48

1 Answer 1


I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :

sudo ufw insert 1 deny from
sudo service ufw restart

But before this, first I had to delete the deny entry using:

sudo ufw status numbered

Get the serial number of the previously entered deny entry for the above port, then

sudo ufw delete <serial number >

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.