Question

Port Ranges Set to DENY in UFW (Firewall) are Still Allowing Traffic on Those Ports

Here is a screen grab of ‘grep “Failed password” /var/log/auth.log’ for reference: https://imgur.com/a/G2bwrZO

I have the port range 30999:59999 set to DENY IN from ANYWHERE for udp and tcp traffic, yet I’m still receiving login attempts within the ranges of blocked ports.

Can anybody spot a misconfiguration, or perhaps explain what I’m missing with UFW?

Subscribe
Share

Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Hi there,

Those ports are the port on the clients that are trying to connect to your SSH service.

Most outgoing connections on a system are made from the upper port ranges. For example on Linux, outgoing ports are chosen from 32768 - 61000 by default.

So to prevent this from happening, you actually need to close down port 22 on your server.

You could do that and then only allow your own IP address to access that port.

Hope that this helps.

Best,

Bobby