1
sudo ufw deny from 182.100.67.120
sudo service ufw restart

Yet, continuous entries in /var/log/auth.log

Feb 18 03:40:01 service sshd[2729]: Failed password for root from 182.100.67.120 port 51942 ssh2

If the IP is banned in UFW, why it is still getting into ssh login?

  • Try " sudo ufw status verbose " and past the output – Aravind Feb 18 '18 at 9:48
0

I figured out. Since port 22 is already open from anywhere, to block an IP to port 22, the deny entry has to go above the allow anywhere entry in UFW list. So the right command is (just inserting to the top of the list) :

sudo ufw insert 1 deny from 182.100.67.120
sudo service ufw restart

But before this, first I had to delete the deny entry using:

sudo ufw status numbered

Get the serial number of the previously entered deny entry for the above port, then

sudo ufw delete <serial number >

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.