I've been tailing my server's access log while working today, and have noticed one of my client's wordpress sites getting hammered with login attempts from an IP from out of the country.

I wanted to deny access from this IP address and tried the following ufw command:

sudo ufw deny from xx.xx.xx.xx to any

I see the rule has been added and the firewall is active, but I'm still seeing a ton of post's to the login page from that ip address.

I've also tried to use iptables, though I'm not very familiar with the tool:

sudo iptables -A INPUT -s xx.xx.xx.xx -j DROP

Have I gone about this wrong? I would think that after denying access to the ip address that it wouldn't show up in my apache access log with a 200 ok status for the post to the login page.

Edit: As I mentioned, ufw is active and the rule is in place, here's the output of ufw status (with the ip blocked out):

root@mel:~# ufw status
Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80                         ALLOW       Anywhere
1723                       ALLOW       Anywhere
8080                       ALLOW       Anywhere
6273                       ALLOW       Anywhere
36728                      DENY        Anywhere
Anywhere                   DENY        xx.xx.xx.xx
22                         ALLOW       Anywhere (v6)
80                         ALLOW       Anywhere (v6)
1723                       ALLOW       Anywhere (v6)
8080                       ALLOW       Anywhere (v6)
6273                       ALLOW       Anywhere (v6)
36728                      DENY        Anywhere (v6)
  • 1
    What is the output of sudo ufw status?
    – Diamond
    Jan 12, 2016 at 15:33
  • @bangal, I've added it in and edit.
    – rmmoul
    Jan 12, 2016 at 15:43
  • 2
    You need to move the ufw deny from xx.xx.xx.xx to any at the top/beginning other allow rules, then it will work.
    – Diamond
    Jan 12, 2016 at 15:49
  • Although, this is not the best way to mitigate such attacks. Try to use fail2ban that can block this dynamically.
    – Diamond
    Jan 12, 2016 at 16:54
  • @bengal, I have fail2ban set up as well, but will need to look into why my settings didn't ban him after too many login attempts or how I can set it up to recognize failed wordpress login attempts. I mostly just needed to silence his traffic as it was making it hard to watch the log for what I was working on. grep could have cleaned up the log output for me, but this seemed like a good idea too.
    – rmmoul
    Jan 12, 2016 at 21:07

2 Answers 2


The order of the firewall rules are important. Since you have allowed port 80 for all at the beginning, this rule will match for all request and the deny rule that comes later will never be matched.

So, if you need to block something particluarly, put it at the beginning and then allow all.

To see your rules with a reference number, use this:

sudo ufw status numbered

Then remove the deny rule first that you have added:

sudo ufw delete rule_number_here

Then add it again at the top:

sudo ufw insert 1 deny from xx.xx.xx.xx to any

For further Ref: https://help.ubuntu.com/community/UFW#Deny_Access

Please also note that, ufw is not the best tool to mitigate such attacks. Try to use fail2ban, that can do this dynamically.

  • what if the Deny rules for the IP in question are already at the top before the Allow rules and it's still not blocking the offending IP?
    – stantonk
    Jul 12, 2018 at 5:28
  • @stantonk, there can be other reasons which depends on each configuration and situation. Please ask a new question with your configuration and problems so that people can help you.
    – Diamond
    Jul 12, 2018 at 7:18
  • Have the same issue. Blocked an IP but it keeps pounding the server. stupid people who think too much of themselves can't even create a firewall
    – Allen King
    May 3 at 17:26

For UFW maintenance (add new Deny rules), I usually prefer this order:

  1. Add the New Deny rules
  2. Remove the Allow rules
  3. Add the Allow rules again

So looks like this for ports 80 and 443:

sudo ufw deny from xx.xx.xx.xx to any
sudo ufw delete allow 80/tcp
sudo ufw delete allow 443/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

And by last, I check if rules are Ok

sudo ufw status numbered
  • HTTP/3 use UDP, so maybe better is to ufw allow https (add both, TCP and UDP)
    – Pablo A
    Feb 19 at 21:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .