2

Is there a way to disable this specific logging? I searched but found nothing for this. I have the rule enabled to allow HTTPS in and it's showing again. Most of the entries are with RST flag. I have fail2ban enabled which is looking for port scan in ufw.log and I don't want to block some IP's because of this HTTPS block.

Dec 16 09:00:04 srv kernel: [] [UFW BLOCK] IN= OUT= MAC= SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=55 ID=0 DF PROTO=TCP SPT=3493 DPT=443 WINDOW=0 RES=0x00 RST URGP=0

Here is a similar post.

1

I couldn't find an answer to disable this specific logging. In Fail2Ban I added something in the ignoreregex parameter.

My ufw-port-scan.conf filter:

[Definition]
failregex = .*\[UFW BLOCK\] IN=.* SRC=<HOST>
ignoreregex = .*\[UFW BLOCK] IN=.* SRC=<HOST> .* DPT=443

Now Fail2Ban wil not ban anything with port 443. I hope this can help someone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.