How to Use Uncomplicated Firewall (UFW) to Rate Limit Incoming Connections on Ubuntu

Brute-force attacks against SSH, FTP, and web login pages are a constant threat for public-facing Ubuntu servers. While tools like Fail2Ban offer advanced log-parsing protection, Ubuntu’s default Uncomplicated Firewall (UFW) includes a built-in rate-limiting feature that can instantly block aggressive connection attempts without requiring complex configuration.

How UFW Rate Limiting Works

The limit command in UFW tracks incoming connections from specific IP addresses. If an IP address attempts to initiate six or more connections within a 30-second window, UFW will automatically drop further connections from that IP. This is highly effective against automated bots scanning for open ports or attempting password spraying.

How to Enable Rate Limiting for SSH

The most common use case for UFW rate limiting is protecting the SSH daemon (port 22).

1. Open your terminal and connect to your Ubuntu server.
2. Ensure UFW is active by running: sudo ufw status
3. If you previously allowed SSH using a standard rule (e.g., sudo ufw allow ssh), you should delete it first to avoid rule conflicts. Find the rule number using sudo ufw status numbered and delete it with sudo ufw delete [number].
4. Apply the rate limit rule to SSH by running the following command:

   sudo ufw limit ssh

   Alternatively, you can specify the port directly:

   sudo ufw limit 22/tcp

5. Verify the new rule by checking the status:

   sudo ufw status

   You should see the action listed as LIMIT instead of ALLOW.

How to Rate Limit Custom Ports

You can apply this protection to any port. For example, if you are running a custom admin panel on port 8443 and notice brute-force attempts, you can rate limit it:

sudo ufw limit 8443/tcp

By implementing UFW’s rate limiting, you add an immediate, low-overhead layer of security that drastically reduces the effectiveness of automated attacks on your Ubuntu infrastructure.