9

I've been tailing my server's access log while working today, and have noticed one of my client's wordpress sites getting hammered with login attempts from an IP from out of the country.

I wanted to deny access from this IP address and tried the following ufw command:

sudo ufw deny from xx.xx.xx.xx to any

I see the rule has been added and the firewall is active, but I'm still seeing a ton of post's to the login page from that ip address.

I've also tried to use iptables, though I'm not very familiar with the tool:

sudo iptables -A INPUT -s xx.xx.xx.xx -j DROP

Have I gone about this wrong? I would think that after denying access to the ip address that it wouldn't show up in my apache access log with a 200 ok status for the post to the login page.

Edit: As I mentioned, ufw is active and the rule is in place, here's the output of ufw status (with the ip blocked out):

root@mel:~# ufw status
Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80                         ALLOW       Anywhere
1723                       ALLOW       Anywhere
8080                       ALLOW       Anywhere
6273                       ALLOW       Anywhere
36728                      DENY        Anywhere
Anywhere                   DENY        xx.xx.xx.xx
22                         ALLOW       Anywhere (v6)
80                         ALLOW       Anywhere (v6)
1723                       ALLOW       Anywhere (v6)
8080                       ALLOW       Anywhere (v6)
6273                       ALLOW       Anywhere (v6)
36728                      DENY        Anywhere (v6)
  • 1
    What is the output of sudo ufw status? – Diamant Jan 12 '16 at 15:33
  • @bangal, I've added it in and edit. – rmmoul Jan 12 '16 at 15:43
  • 2
    You need to move the ufw deny from xx.xx.xx.xx to any at the top/beginning other allow rules, then it will work. – Diamant Jan 12 '16 at 15:49
  • Although, this is not the best way to mitigate such attacks. Try to use fail2ban that can block this dynamically. – Diamant Jan 12 '16 at 16:54
  • @bengal, I have fail2ban set up as well, but will need to look into why my settings didn't ban him after too many login attempts or how I can set it up to recognize failed wordpress login attempts. I mostly just needed to silence his traffic as it was making it hard to watch the log for what I was working on. grep could have cleaned up the log output for me, but this seemed like a good idea too. – rmmoul Jan 12 '16 at 21:07
18

The order of the firewall rules are important. Since you have allowed port 80 for all at the beginning, this rule will match for all request and the deny rule that comes later will never be matched.

So, if you need to block something particluarly, put it at the beginning and then allow all.

To see your rules with a reference number, use this:

sudo ufw status numbered

Then remove the deny rule first that you have added:

sudo ufw delete rule_number_here

Then add it again at the top:

sudo ufw insert 1 deny from xx.xx.xx.xx to any

For further Ref: https://help.ubuntu.com/community/UFW#Deny_Access

Please also note that, ufw is not the best tool to mitigate such attacks. Try to use fail2ban, that can do this dynamically.

Here is a relevant how-to: How To Protect an Apache Server with Fail2Ban on Ubuntu 14.04

  • what if the Deny rules for the IP in question are already at the top before the Allow rules and it's still not blocking the offending IP? – stantonk Jul 12 '18 at 5:28
  • @stantonk, there can be other reasons which depends on each configuration and situation. Please ask a new question with your configuration and problems so that people can help you. – Diamant Jul 12 '18 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.