14

I have a lot of these entries in my log:

Sep 22 12:20:23 server0187 kernel: [    7.267934] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=27738 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:20:23 server0187 kernel: [    7.688848] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=27738 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:20:24 server0187 kernel: [    7.992988] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=27738 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:20:32 server0187 kernel: [   16.219594] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=52457 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:20:39 server0187 kernel: [   23.217712] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=7040 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:20:40 server0187 kernel: [   24.130220] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=7040 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:20:44 server0187 kernel: [   28.063447] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=61.62.8.132 DST=se.rv.er.ip LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=33267 DF PROTO=TCP SPT=33345 DPT=23 WINDOW=14520 RES=0x00 SYN URGP=0 
Sep 22 12:20:45 server0187 kernel: [   29.063934] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=61.62.8.132 DST=se.rv.er.ip LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=33268 DF PROTO=TCP SPT=33345 DPT=23 WINDOW=14520 RES=0x00 SYN URGP=0 
Sep 22 12:20:47 server0187 kernel: [   31.063621] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=61.62.8.132 DST=se.rv.er.ip LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=33269 DF PROTO=TCP SPT=33345 DPT=23 WINDOW=14520 RES=0x00 SYN URGP=0 
Sep 22 12:20:50 server0187 kernel: [   34.272558] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=37595 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:20:50 server0187 kernel: [   34.667044] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=37595 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:21:08 server0187 kernel: [   52.296316] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=113.69.80.129 DST=se.rv.er.ip LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=63510 PROTO=TCP SPT=22917 DPT=23 WINDOW=31379 RES=0x00 SYN URGP=0 
Sep 22 12:21:39 server0187 kernel: [   83.646607] [UFW BLOCK] IN=ens3 OUT= MAC=56:00:21:32:65:eb:fe:00:00:32:65:eb:08:99 SRC=151.233.57.112 DST=se.rv.er.ip LEN=44 TOS=0x00 PREC=0x00 TTL=37 ID=56703 PROTO=TCP SPT=25625 DPT=23 WINDOW=30217 RES=0x00 SYN URGP=0 

my ufw rules is pretty standard:

22/tcp (OpenSSH)           ALLOW IN    Anywhere                  
80,443/tcp (Nginx Full)    ALLOW IN    Anywhere                  
80,443/tcp                 ALLOW IN    Anywhere                  
25                         ALLOW IN    Anywhere                  
143                        ALLOW IN    Anywhere                  
993                        ALLOW IN    Anywhere                  
22                       ALLOW IN    Anywhere                  
21                       ALLOW IN    Anywhere                  
21/tcp                   ALLOW IN    Anywhere                  
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)             
80,443/tcp (Nginx Full (v6)) ALLOW IN    Anywhere (v6)             
80,443/tcp (v6)            ALLOW IN    Anywhere (v6)             
25 (v6)                    ALLOW IN    Anywhere (v6)             
143 (v6)                   ALLOW IN    Anywhere (v6)             
993 (v6)                   ALLOW IN    Anywhere (v6)             
22 (v6)                  ALLOW IN    Anywhere (v6)             
21 (v6)                  ALLOW IN    Anywhere (v6)             
21/tcp (v6)              ALLOW IN    Anywhere (v6) 

How do I get rid of these?

3
  • Any particular reason you don't want it notifying about traffic being blocked?
    – Thomas Ward
    Sep 22, 2016 at 12:32
  • @ThomasWard I'm just not sure what its about and should I be concerned cause they appear a few times in the log.
    – Nimbuz
    Sep 22, 2016 at 12:33
  • @ThomasWard There're LOTs of these entries in all logs thats why I'm worried.
    – Nimbuz
    Sep 22, 2016 at 13:10

5 Answers 5

17

Before you read this answer, consider the following:

  1. There are 65,534 usable ports (1 - 65534) when connecting to a system, and a bunch of different protocols; this means there is a HUGE number of potential "blocked" connections based on whatever criterion is set up in your firewall rules for 'permitted traffic'.

  2. Anything Internet-facing will be getting connection attempts from various things to the box, such as:

    • Legitimate Permitted Traffic
    • Service scanners
    • Brute forcers
    • Malware / Hackers
    • etc. (pretty much anything that wants to try and connect, whether allowed or not).
  3. Anything publicly facing the Internet will get things trying to find services running on the system, or try and scan the box for potential breach points. Hence the BLOCK alerts in the syslog.

  4. Firewall "BLOCK" alerts mean your firewall is working as intended, and you shouldn't really be super concerned about seeing a lot of these alerts, especially if your system is directly facing the Internet (and not behind a router, etc.).


Now to address your concern in your comments about "There's a lot of these entries" and "that's why I'm worried".

When you run a whitelisting firewall with UFW, there is a default rule added as a result of the default UFW configurations which will automatically add a LOG rule for any traffic not accepted or otherwise handled by the firewall rules. For example, let's say that I have a server, and I set it to permit only SSH from the IP address 1.2.3.4. Any other traffic to my server not related to traffic from the server going outbound or SSH traffic from 1.2.3.4 to my server (and vice versa in the opposite direction) will be blocked, and a UFW BLOCK alert will go out to the system logs to indicate that the traffic that doesn't match one of my permitted rules was blocked. (That is, only traffic from 1.2.3.4 to port 22 (SSH), or related bidirectional traffic to that connection, will trigger a BLOCK alert)

Should you be concerned about this? Absolutely not. Web facing services, servers, networks, etc. get a ton of traffic to them, from service scanners, legitimate connections, malicious threat actors, etc. It is not unusual to see a lot of attempts to connect to a network from the outside from large ranges of IP addresses, if your system/server is Internet facing, because that type of traffic is usually blocked.


Now to address your original question of how to disable the UFW BLOCK alerts. While I do not recommend disabling the alerts (because this indicates your firewall is working as intended), you can disable the UFW alert log items by doing the following:

sudo ufw logging off

Note that I really don't recommend you disable your logging of blocked traffic unless you really need to (such as syslog taking up too much disk space, which is not really that common even in these cases), but it's up to you whether you do or not.

2
  • 1
    Logging every blocked connection attempt is not wise, as it can lead to a Denial of Service if the attacker floods the server with cheap connection attempts cause a disk-full issue. Also, who is going to actually parse or read these logs? They should be off by default, and only enabled when needed.
    – Sam Sirry
    Mar 18, 2023 at 11:05
  • 2
    @SamSirry syslog is on a rotation by systemd and logrotate - even if it 'loads up data' it will rotate and journald will wipe the journal logs anyways if it needs to. Also, the defaults for ufw are to not log every block, but log only one occurrence for every 20 matches, so it's not really a DoS vector in that case.
    – Thomas Ward
    Mar 18, 2023 at 21:46
14

If the logs are annoying you because they polute your syslog, please edit /etc/rsyslog.d/20-ufw.conf, the last line (in 18.04) reads

# & stop

remove the # and then restart logging:

sudo service rsyslog restart

Now you should be able to find your ufw logs only in /var/log/ufw.log

1
  • 1
    On debian 11.5: sudo systemctl restart syslog-ng.service
    – KolonUK
    Jan 10, 2023 at 9:56
1

There is no explicit rule to deny tcp/23(telnet) in existing rules in this post, the implicit rule is denying/logging (default). To halt the logging and still deny - create an explicit deny rule in on ens3.

ufw deny in on ens3 to any port 23

or simply firewall telnet to deny telnet in on all interfaces in host:

ufw deny in 23

1

Put this at the very end of your firewall rules. Make sure it is always the last rule entry:

Anywhere DENY Anywhere

This is the same as the deny all rule there by default except it does not log. This enables one to continue to log the allow rules coming before the deny all rule at the very end of the rules.

0

To get rid of those, I created a Python script to parse these IPs and explicitly deny the communication with my server. This way, the syslogs are clean of warnings, and those (about 3000) malicious IPs cannot ping me any more.

import glob
import gzip
import re
import subprocess

def get_lines(log_glob):
    """Return an iterator of each line in all files matching log_glob.
    Lines are sorted most recent first.
    Files are sorted by the integer in the suffix of the log filename.
    Suffix may be one of the following:
         .X (where X is an integer)
         .X.gz (where X is an integer)
    If the filename does not end in either suffix, it is treated as if X=0
    https://www.saltycrane.com/blog/2010/01/iterating-over-lines-multiple-linux-log-files-using-python/
    """
    def sort_by_suffix(fname):
        m = re.search(r'.(?:\.(\d+))?(?:\.gz)?$', fname)
        if m.lastindex:
            suf = int(m.group(1))
        else:
            suf = 0
        return suf

    filelist = glob.glob(log_glob)
    for filename in sorted(filelist, key=sort_by_suffix):
        if filename.endswith('.gz'):
            fh = gzip.open(filename)
        else:
            fh = open(filename)
        for line in reversed(fh.readlines()):
            yield line
        fh.close()

if __name__ == "__main__":

    ip = "here.your.ip.goes"
    mac = "here::your::mac"
    eth = "here your eth name"
    # https://stackoverflow.com/questions/11264005/using-a-regex-to-match-ip-addresses-in-python
    pat = re.compile(r" \[UFW BLOCK\] IN="+eth+" OUT= MAC="+mac+" SRC=(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) DST="+ip+" LEN=")

    badips = []
    for i, line in enumerate(get_lines('/var/log/ufw*')):
        line = line.rstrip()
        line = str(line)
        # ~ print(i, line)
        res = re.search(pat,line)
        if res is None:
            if re.search(r"SRC=your\.ip\.addr\.", line) is not None:
                # ~ print('Broadcast',line)
                continue
            else:
                # ~ print(line)
                continue
        else:
            badip = '.'.join(res.groups(0))
            badips.append(badip)
    badips = sorted(list(dict.fromkeys(badips)))
    # ~ print(badips)
    ips24 = []
    for ip in badips:
        if len(ips24):
            lastip = ips24[-1].split('.')
            thisip = ip.split('.')
            if lastip[0:3] == thisip[0:3]:
                if lastip[3] != "0/24" :
                    lastip[3] = "0/24"
                    ips24[-1] = '.'.join(lastip)
            else:
                ips24.append(ip)
        else:
            ips24.append(ip)
    # Remove anyway all from subnet
    for i, ip in enumerate(ips24):
        theip = ip.split('.')
        if theip[3] != "0/24":
            theip[3] = "0/24"
            ips24[i] = '.'.join(theip)
    ips24 = sorted(list(dict.fromkeys(ips24)))
    # ~ print(ips24)
    ips16 = []
    for ip in ips24:
        if len(ips16):
            lastip = ips16[-1].split('.')
            thisip = ip.split('.')
            if lastip[0:2] == thisip[0:2]:
                if lastip[3] != "0/16" or lastip[2] != "0":
                    lastip[3] = "0/16"
                    lastip[2] = "0"
                    ips16[-1] = '.'.join(lastip)
            else:
                ips16.append(ip)
        else:
            ips16.append(ip)
    ips16 = sorted(list(dict.fromkeys(ips16)))
    # ~ print(ips16)

    ufips = str(subprocess.run(['sudo','ufw','status'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True)).split('\\n')
    uips = []
    pat = re.compile(r"Anywhere[ ]+DENY[ ]+(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?[/]?[12][46])")
    for uip in ufips:
        res = re.search(pat,uip)
        if res is None:
            # ~ print (uip)
            continue
        else:
            badip = '.'.join(res.groups(0))
            # ~ print(badip)
            uips.append(badip)
    uips = sorted(list(dict.fromkeys(uips)))
    # ~ print(uips[:10])

    newips = []
    for ip in ips16:
        if not ip in uips:
            newips.append(ip)
    print(len(badips),len(ips24),len(ips16),len(uips),len(newips))

    for ip in newips:
        print(ip)
        proc = subprocess.Popen(['sudo','ufw','deny','from',ip,'to','any'])
        proc.wait()

    print('Done.')
1
  • A more practical approach I follow now, as suggested in the comment above askubuntu.com/a/1383632/1179344: To whitelist which IPs you want to allow connections from, and then deny everything else as last rule. Feb 2, 2022 at 0:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .