How to Use UFW Rate Limiting to Prevent SSH Brute Force Attacks on Ubuntu

One of the most common cyber attacks against Internet-facing Ubuntu servers is an SSH brute force attack. Automated botnets constantly scan IP addresses for open port 22 and attempt to log in using thousands of common username and password combinations per minute. While disabling password authentication and relying entirely on SSH keys is the most secure defense, this is not always possible in every environment. The Uncomplicated Firewall (UFW) built into Ubuntu offers a simple but highly effective mitigation strategy: rate limiting. By configuring UFW to limit SSH connections, you can automatically block IP addresses that attempt to connect too frequently, rendering brute force attacks mathematically useless.

How UFW Rate Limiting Works

UFW is a user-friendly front-end for iptables (or nftables on newer systems). When you apply a rate limit rule in UFW, the firewall begins tracking incoming connection attempts on the specified port. If a single IP address attempts to initiate six or more connections within a rolling 30-second window, UFW automatically drops all further traffic from that IP address. This slows down brute force tools so drastically that attackers abandon your server and move on to easier targets, while completely preserving access for legitimate administrators who only need to connect occasionally.

Checking Your Current UFW Status

Before applying new rules, you must ensure UFW is active and see what rules are currently in place.

1. Log into your Ubuntu server.
2. Run the command: sudo ufw status
3. If the output says Status: inactive, you must enable the firewall. Warning: Before enabling UFW, ensure you have an allow rule for SSH, or you will lock yourself out of the server immediately.
4. To add a standard SSH allow rule and enable UFW, run: sudo ufw allow ssh sudo ufw enable

Applying the Rate Limit Rule

If you currently have a standard allow ssh rule, you need to replace it with a limit ssh rule.

1. Apply the rate limit rule by running: sudo ufw limit ssh/tcp
2. Verify the rule has been applied by running: sudo ufw status

You should see a rule listed as LIMIT rather than ALLOW for port 22 (or whatever custom port you run SSH on). The /tcp specification ensures the rule only applies to TCP connections, which is the protocol SSH uses.

Understanding the Impact on Legitimate Users

A limit of six connections per 30 seconds is generous enough for any normal administrative workflow. Logging into a server, opening a new session, or running a script that connects via SCP typically involves one or two connections. The only scenario where a legitimate user might trigger the block is if they are running a poorly designed automation script that rapidly opens and closes hundreds of separate SSH connections instead of multiplexing a single connection or keeping it alive.

Monitoring Blocked IP Addresses

When UFW triggers a rate limit block, it logs the event. You can monitor your system logs to see how many brute force attempts your new rule is stopping.

1. Use the grep utility to search the UFW logs for dropped packets: sudo grep "UFW BLOCK" /var/log/ufw.log | grep "DPT=22"

This command filters the firewall log specifically for packets blocked on Destination Port (DPT) 22. You will likely see a steady stream of IP addresses being rejected, proving that your rate limiting is actively protecting your server infrastructure without requiring complex third-party tools like Fail2Ban.