Securing a Linux server involves multiple layers of defence, but establishing a robust firewall is arguably the most critical first step. Uncomplicated Firewall (UFW) is the default firewall configuration tool for Ubuntu. As its name suggests, it is designed to simplify the complex process of configuring iptables. While most administrators use UFW to allow or deny traffic on specific ports, it is equally powerful when you need to block malicious traffic originating from specific IP addresses or entire subnets.
In this guide, you will learn how to leverage UFW to block specific IP ranges and secure your Ubuntu server from targeted attacks, brute-force attempts, or unwanted regional traffic.
Prerequisites
- A server running Ubuntu (this guide applies to 20.04, 22.04, and newer).
- Sudo or root privileges.
- UFW installed and active on your system.
Note: If UFW is not active, you can enable it by running sudo ufw enable. Ensure you have allowed SSH traffic (sudo ufw allow ssh) before enabling the firewall, otherwise, you may lock yourself out of your server.
Step 1: Understanding CIDR Notation
To block an entire range of IP addresses efficiently, you need to use Classless Inter-Domain Routing (CIDR) notation. CIDR notation represents an IP address and its associated routing prefix (the subnet mask). For example, instead of writing out every IP address from 192.168.1.0 to 192.168.1.255, you simply write 192.168.1.0/24.
If you identify a malicious IP address but suspect the attacker is using multiple addresses from the same hosting provider, blocking the entire CIDR block (subnet) is the safest approach.
Step 2: Blocking a Specific IP Range
To deny all incoming connections from a specific subnet, you use the deny from command followed by the CIDR range.
Open your terminal and execute the following command (replacing the IP range with the one you wish to block):
sudo ufw deny from 203.0.113.0/24UFW will output Rule added, confirming that traffic from any IP address within that range is now blocked across all ports.
Blocking Access to a Specific Port
Sometimes you may want to block an IP range from accessing a specific service (like an SSH or web server) while allowing them to access other services. To do this, specify the destination port in your command.
For example, to block the 203.0.113.0/24 subnet from accessing port 22 (SSH), use:
sudo ufw deny from 203.0.113.0/24 to any port 22Step 3: Managing UFW Rule Order (Crucial)
One of the most common mistakes administrators make with UFW is ignoring rule order. UFW processes rules sequentially from top to bottom. The moment a packet matches a rule, UFW stops evaluating further rules for that packet.
If you have an existing rule that says Allow Anywhere to Port 80, and you subsequently add a rule that says Deny 203.0.113.0/24, the malicious IP range will still be able to access Port 80 because the “Allow” rule was processed first.
To fix this, you must insert your “Deny” rule before your general “Allow” rules.
- First, view your numbered rules:
sudo ufw status numbered - Identify the position where your block rule needs to go (usually position 1).
- Insert the rule at that specific position using the
insertcommand:sudo ufw insert 1 deny from 203.0.113.0/24
By placing the block rule at position 1, you guarantee that UFW will drop the malicious traffic before it ever checks your “Allow” rules.
Step 4: Removing a Block Rule
If you accidentally block the wrong IP range or wish to lift a restriction, you can easily delete the rule.
The safest way to delete a rule is by its number. Run sudo ufw status numbered to find the rule number, and then delete it:
sudo ufw delete 1You will be prompted to confirm the deletion. Press y to proceed.
Mastering UFW provides you with a powerful tool for maintaining server security. By understanding CIDR notation and rule hierarchy, you can effectively shield your Ubuntu environments from coordinated network attacks.