Understanding UFW and Fail2ban

Oct 13, 2025 by talynt.org 16 views

Introduction

As a system administrator, protecting your server from malicious attacks is a top priority. One of the most common types of attacks is the use of automated scripts to scan for vulnerabilities and launch brute-force attacks on your server. In this article, we will discuss how to use UFW (Uncomplicated Firewall) and Fail2ban to block these types of attacks on a server running Nginx.

Understanding UFW and Fail2ban

UFW

UFW is a firewall configuration tool that provides a simple and easy-to-use interface for managing the firewall on your server. It allows you to create rules to block incoming and outgoing traffic based on IP addresses, ports, and protocols.

Fail2ban

Fail2ban is a security tool that monitors log files for signs of unauthorized access and bans the IP addresses that are attempting to access your server. It can be configured to work with a variety of services, including Nginx.

Configuring UFW and Fail2ban with Nginx

Step 1: Install UFW and Fail2ban

To start, you will need to install UFW and Fail2ban on your server. You can do this by running the following commands:

sudo apt-get update
sudo apt-get install ufw fail2ban

Step 2: Configure UFW

Next, you will need to configure UFW to allow incoming traffic on the ports that Nginx uses. You can do this by running the following commands:

sudo ufw allow http
sudo ufw allow https

You will also need to allow incoming traffic on the port that Fail2ban uses. You can do this by running the following command:

sudo ufw allow 123

Step 3: Configure Fail2ban

To configure Fail2ban, you will need to create a new filter to monitor the Nginx log files for signs of unauthorized access. You can do this by creating a new file in the /etc/fail2ban/filter.d directory called nginx.conf. The contents of this file should be:

[Definition]
failregex = ^<HOST> -.*"GET.*HTTP/.*" 404
ignoreregex =

You will also need to create a new jail to monitor the Nginx log files. You can do this by creating a new file in the /etc/fail2ban/jails.d directory called nginx.conf. The contents of this file should be:

[nginx-botsearch]
enabled = true
filter = nginx-botsearch
action = iptables-allports[name=nginx-botsearch]
logpath = /var/log/nginx/access.log
maxretry = 3

Step 4: Restart UFW and Fail2ban

Finally, you will need to restart UFW and Fail2ban to apply the new configuration. You can do this by running the following commands:

sudo service ufw restart
sudo service fail2ban restart

Troubleshooting

If UFW and Fail2ban are not working as expected, there are a few things you can check:

Make sure that UFW is enabled by running the following command:

sudo ufw status

Make sure that Fail2ban is enabled by running the following command:

sudo service fail2ban status

Check the log files to see if there are any errors or warnings. You can do this by running the following commands:

sudo tail -f /var/log/ufw.log
sudo tail -f /var/log/fail2ban.log

Conclusion

In this article, we discussed how to use UFW and Fail2ban to block attack scripts on a server running Nginx. We covered the basics of UFW and Fail2ban, and provided step-by-step instructions for configuring them to work with Nginx. We also discussed some common troubleshooting steps that you can take if UFW and Fail2ban are not working as expected.

Additional Resources

Ipv6, Cname Record, Fail2ban, Ufw

Ipv6
Cname Record
Fail2ban
Ufw
UFW + Fail2ban Q&A =====================

Q: What is UFW and how does it work?

A: UFW (Uncomplicated Firewall) is a firewall configuration tool that provides a simple and easy-to-use interface for managing the firewall on your server. It allows you to create rules to block incoming and outgoing traffic based on IP addresses, ports, and protocols.

Q: What is Fail2ban and how does it work?

A: Fail2ban is a security tool that monitors log files for signs of unauthorized access and bans the IP addresses that are attempting to access your server. It can be configured to work with a variety of services, including Nginx.

Q: How do I configure UFW to work with Nginx?

A: To configure UFW to work with Nginx, you will need to allow incoming traffic on the ports that Nginx uses. You can do this by running the following commands:

sudo ufw allow http
sudo ufw allow https

You will also need to allow incoming traffic on the port that Fail2ban uses. You can do this by running the following command:

sudo ufw allow 123

Q: How do I configure Fail2ban to work with Nginx?

A: To configure Fail2ban to work with Nginx, you will need to create a new filter to monitor the Nginx log files for signs of unauthorized access. You can do this by creating a new file in the /etc/fail2ban/filter.d directory called nginx.conf. The contents of this file should be:

[Definition]
failregex = ^<HOST> -.*"GET.*HTTP/.*" 404
ignoreregex =

[nginx-botsearch]
enabled = true
filter = nginx-botsearch
action = iptables-allports[name=nginx-botsearch]
logpath = /var/log/nginx/access.log
maxretry = 3

Q: How do I restart UFW and Fail2ban after making changes to the configuration?

A: To restart UFW and Fail2ban after making changes to the configuration, you can run the following commands:

sudo service ufw restart
sudo service fail2ban restart

Q: How do I troubleshoot issues with UFW and Fail2ban?

A: If UFW and Fail2ban are not working as expected, there are a few things you can check:

Make sure that UFW is enabled by running the following command:

sudo ufw status

Make sure that Fail2ban is enabled by running the following command:

sudo service fail2ban status

Check the log files to see if there are any errors or warnings. You can do this by running the following commands:

sudo tail -f /var/log/ufw.log
sudo tail -f /var/log/fail2ban.log

Q: Can I use UFW and Fail2ban with other services besides Nginx?

A: Yes, you can use UFW and Fail2ban with other services besides Nginx. UFW and Fail2ban are designed to be flexible and can be configured to work with a variety of services.

Q: How do I configure UFW and Fail2ban to work with IPv6?

A: To configure UFW and Fail2ban to work with IPv6, you will need to make a few changes to the configuration files. You can do this by adding the following lines to the /etc/fail2ban/jails.d directory:

[nginx-botsearch]
enabled = true
filter = nginx-botsearch
action = iptables-allports[name=nginx-botsearch]
logpath = /var/log/nginx/access.log
maxretry = 3

You will also need to add the following lines to the /etc/ufw/before.rules file:

# IPv6 rules
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
COMMIT

Q: How do I configure UFW and Fail2ban to work with CNAME records?

A: To configure UFW and Fail2ban to work with CNAME records, you will need to make a few changes to the configuration files. You can do this by adding the following lines to the /etc/fail2ban/jails.d directory:

[nginx-botsearch]
enabled = true
filter = nginx-botsearch
action = iptables-allports[name=nginx-botsearch]
logpath = /var/log/nginx/access.log
maxretry = 3

You will also need to add the following lines to the /etc/ufw/before.rules file:

# CNAME rules
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
COMMIT

Conclusion

In this article, we have covered some of the most frequently asked questions about UFW and Fail2ban. We have discussed how to configure UFW and Fail2ban to work with Nginx, how to troubleshoot issues with UFW and Fail2ban, and how to configure UFW and Fail2ban to work with IPv6 and CNAME records. We hope that this article has been helpful in answering some of your questions about UFW and Fail2ban.