Securing a Linux server is an ongoing process, but setting up a robust firewall is arguably the most critical first step. For Ubuntu users, the Uncomplicated Firewall (UFW) provides an accessible, user-friendly interface for managing iptables rules. While setting up basic allow/deny rules for common ports (like SSH or HTTP) is straightforward, there are times when you need more granular control—specifically, blocking entire ranges of malicious IP addresses.
In this guide, we will demonstrate how to configure UFW on Ubuntu to block specific IP addresses and entire IP ranges using CIDR notation, helping you protect your server from targeted attacks, spam networks, or known bad actors.
Prerequisites
Before proceeding, ensure you have:
- A server running Ubuntu (these steps apply to 20.04, 22.04, and 24.04).
- A user account with
sudoprivileges. - UFW installed (it comes pre-installed on most Ubuntu distributions).
Warning: If you are configuring a remote server via SSH, ensure you have explicitly allowed your own IP address or the SSH port (default 22) before enabling UFW. Failing to do so will lock you out of your server.
Step 1: Check UFW Status and Enable
First, check the current status of your firewall to see if it is active and what rules are currently applied.
sudo ufw status verboseIf the status is inactive, you need to enable it. Remember to allow SSH connections first:
sudo ufw allow ssh
sudo ufw enableType y and press Enter when prompted about disrupting existing SSH connections.
Step 2: How to Block a Single IP Address
If you have identified a single IP address that is repeatedly attempting to brute-force your login or scraping your website, you can block it using a simple deny from rule.
To block all incoming traffic from the IP address 203.0.113.50, run:
sudo ufw deny from 203.0.113.50You should see a message stating Rule added.
Step 3: How to Block an Entire IP Range (CIDR)
Often, malicious traffic originates from a block of related IP addresses owned by the same hosting provider or ISP. Instead of blocking them one by one, you can block the entire subnet using Classless Inter-Domain Routing (CIDR) notation.
For example, to block the entire 203.0.113.0/24 subnet (which covers all IPs from 203.0.113.0 to 203.0.113.255), use the following command:
sudo ufw deny from 203.0.113.0/24This single rule is far more efficient for the firewall to process than hundreds of individual IP rules.
Blocking Access to Specific Ports Only
Sometimes you do not want to block an IP entirely, but only restrict it from accessing a specific service. For instance, if an IP range is spamming your web server but you want them to still ping the server, you can block them solely from port 80 (HTTP) and 443 (HTTPS).
sudo ufw deny from 203.0.113.0/24 to any port 80
sudo ufw deny from 203.0.113.0/24 to any port 443Step 4: Verify and Manage Your Rules
After adding your deny rules, it is crucial to verify that they have been applied correctly.
sudo ufw status numberedThis command lists all active rules with a corresponding number. Rule order matters in UFW. The firewall evaluates rules from top to bottom; once a packet matches a rule, UFW applies that rule and stops evaluating.
If you have an “allow all” rule at position 1, and a “deny IP” rule at position 2, the IP will still be allowed because the first rule was matched. To fix this, you must insert your deny rules at the top of the list.
Inserting a Rule at a Specific Position
To ensure a blocked IP range is evaluated before any allow rules, use the insert command:
sudo ufw insert 1 deny from 203.0.113.0/24This places the deny rule at position 1, pushing all other rules down.
Deleting a Rule
If you accidentally block the wrong IP, you can remove the rule using its number from the status numbered list. To delete rule number 3:
sudo ufw delete 3Conclusion
Understanding how to manipulate UFW beyond basic port allowances is vital for maintaining a secure Ubuntu environment. By utilizing CIDR notation and understanding rule priority, you can quickly mitigate threats and reduce unnecessary load on your server from malicious actors.