How to limit SSH (TCP port 22) connections with ufw on Ubuntu Linux

H

ow do I limit ssh connection attempts using UFW (Uncomplicated Firewall) on Ubuntu or Debian Linux server?

 

UFW means Uncomplicated Firewall. It defaults on Ubuntu and can be installed on other Linux distros such as Arch Linux, Debian and more. It is nothing but a front-end for managing a Netfilter firewall. It provides a command line interface and aims to be uncomplicated and easy to use.

Rate limiting with ufw

You can add limit rule. Currently only IPv4 is supported. With this syntax you can deny connections from an IP address that has attempted to initiate 6 or more connections in the last 30 seconds. This option is very useful for services such as sshd.

Syntax

The syntax is pretty simple:

ufw limit ssh various usage ##

ufw limit ssh

 

ufw limit ssh/tcp

 

ufw limit ssh comment  Rate limit for openssh serer

 

if sshd is running on tcp port 2022 ####

ufw limit 2022/tcp comment  SSH port rate limit

The above rules are useful for protecting against brute-force login attacks. When a limit rule is used, ufw will normally allow the connection but will deny connections if an IP address attempts to initiate six or more connections within thirty seconds. Once setup you can verify it with the following command:

$ sudo ufw limit ssh/tcp comment  Rate limit for openssh serer

$ sudo ufw status

 

Sample outputs:

Status: active

 

To                         Action      From

—                         ——      —-

22/tcp                     LIMIT       Anywhere                   # Rate limit for openssh serer

22/tcp (v6)                LIMIT       Anywhere (v6)              # Rate limit for openssh serer

The actual rules are as follows in iptables:

-A ufw-user-input -p tcp -m tcp –dport 22 -m conntrack –ctstate NEW -m recent –set –name DEFAULT –mask 255.255.255.255 –rsource

-A ufw-user-input -p tcp -m tcp –dport 22 -m conntrack –ctstate NEW -m recent –update –seconds 30 –hitcount 6 –name DEFAULT –mask 255.255.255.255 –rsource -j ufw-user-limit

-A ufw-user-input -p tcp -m tcp –dport 22 -j ufw-user-limit-accept

Please note that the new ssh rule will then replace the previous ssh rule.

This entry is 5 of 6 in the Uncomplicated Firewall (UFW) series. Keep reading the rest of the series:

How to install UFW firewall on Ubuntu 16.04 LTS server

How to open ssh port using ufw on Ubuntu/Debian Linux

How to configure ufw to forward port 80/443 to internal server hosted on LAN

How to block an IP address with ufw on Ubuntu Linux server

How to limit SSH (TCP port 22) connections with ufw on Ubuntu Linux

How To: Ubuntu Linux Firewall Open Port Command Using UFW

 

 

Leave a Reply

Your email address will not be published. Required fields are marked *