I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules.

When using sudo ufw status numbered the terminal does not allow all those lines/pages to scroll through, which also would take forever, so I'm looking to find the correct command for sudo ufw delete ....

Fail2ban inserts the following rule:

Anywhere                   REJECT IN   xxx.xxx.xxx.xxx

I already tried sudo ufw delete REJECT IN xxx.xxx.xxx.xxx and sudo ufw delete RECEJCT IN from xxx.xxx.xxx.xxx to Anywhere

What is the correct ufw command/syntax to remove such rule when I know which IP to remove?

As a bonus question. Am I overdoing Fail2Ban / UFW by having a permanent ban after 1 failed attempts? What is a good practise to block all thous brute-force attempts on port SSH/22

  • I prefer acessing ssh via VPN or port knocking than having random ssh services open for the Internet. – Rui F Ribeiro Apr 16 at 13:08
  • Sure, that's an option, but that does not help me with the current situation where I need to delete that one IP :-) Got any tip on ufw syntax to delete the IP? – lipsum Apr 16 at 13:09
  • Maybe try REJECT instead of RECEJCT ;-) – pLumo Apr 16 at 13:18
  • Or if that does not work, you can use ufw status numbered | grep the_ip_address and then ufw delete ##. – pLumo Apr 16 at 13:20
  • @RoVo, Thanks for the spelling check ;-) The ufw status numbered | grep the_ip_address worked Will you make an answer – lipsum Apr 16 at 13:25

You can use grep to filter the ufw status output.

sudo ufw status numbered | grep the_ip_address

and then

sudo ufw delete ###

with ### being the number from the first commands output.

As for your second question:

Imo, fail2ban is good as it slows down bruteforcing, but banning forever using ufw is not very useful as these bruteforcers don't have fixed IPs but use botnets and with every server they hacked they have one more IP.

You should:

  1. Disable root login.
  2. Disable password login or at least have very strong passwords.
  3. Use fail2ban.
  4. Maybe change ssh port.
  • Thank you good Sir! Saved my day – lipsum Apr 16 at 13:30
  • glad I could help :) – pLumo Apr 16 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.