Question

UFW spamming block messages

Hello, I’ve been noticing that systemd-journal has been slowly but steadily eating up RAM (14.55% 2 days ago, 17.27% yesterday, and 18.23% today). When I looked in the logs, I found many breaks in attempts but also a constant stream of these messages:

kernel: [UFW BLOCK] IN=eth0 OUT= MAC=04:01:3b:5c:8a:01:4c:96:14:a4:ab:f0:08:00 SRC=104.236.189.176 DST=162.243.241.41 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=TCP SPT=58773 DPT=6379 WINDOW=65535 RES=0x00 SYN URGP=0

kernel: [UFW BLOCK] IN=eth0 OUT= MAC=04:01:3b:5c:8a:01:4c:96:14:a4:af:f0:08:00 SRC=171.224.207.81 DST=162.243.241.41 LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=13232 PROTO=TCP SPT=45620 DPT=23 WINDOW=40732 RES=0x00 SYN URGP=0

kernel: [UFW BLOCK] IN=eth0 OUT= MAC=04:01:3b:5c:8a:01:4c:96:14:a4:ab:f0:08:00 SRC=107.6.116.106 DST=162.243.241.41 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=5786 PROTO=TCP SPT=55207 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0

kernel: [UFW BLOCK] IN=eth0 OUT= MAC=04:01:3b:5c:8a:01:4c:96:14:a4:ab:f0:08:00 SRC=111.132.227.100 DST=162.243.241.41 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=13331 DF PROTO=TCP SPT=32958 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0

kernel: [UFW BLOCK] IN=eth0 OUT= MAC=04:01:3b:5c:8a:01:4c:96:14:a4:ab:f0:08:00 SRC=111.132.227.100 DST=162.243.241.41 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=13332 DF PROTO=TCP SPT=32958 DPT=23 WINDOW=5840 RES=0x00 SYN

When I’m using the control panel from digitalocean, I actually see all of these messages being printed out right off the terminal, that doesn’t seems normal.

I’m not sure what these are and what to do of them.

My ufw is configured to allow http, ssh, https. Logging set to low, default to deny incoming traffic and to allow outgoing traffic.


Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

@tri125

That’s the reason we use firewalls :-). If it’s showing block messages, that’s normal. That means that a connection attempt was blocked.

SRC = The IP that attempted to connect.

DST = The IP of your server.

PROTO = The protocol used by the attempted connection.

DPT = The destination port, or port they were trying to connect to.

A firewall, like most software, is going to use resources. It’s a trade off, though you’re going to use far fewer resources than you would if you were allowing the connection attempts to be made without a firewall installed.

With a firewall installed and blocking, as you have it setup, those attempting to connect are blocked before they can even attempt to authenticate.

When connected to Console from the DigitalOcean control panel, seeing those messages is also normal. If you use Terminal (MacOS) or PuTTy (Windows) and connect over SSH, you won’t see them as you do in the Console as Console handles things a little different.

As long as you are seeing the blocks, you shouldn’t have anything to worry about. Your IP is public, attempts to login are going to occur. Add to that the fact that someone else may have had the same IP you have before you had it, and it could be a matter of mistaken attempted access (i.e. someone didn’t update their configuration).

Firewalls will use up resources though, but that comes with having a publicly accessible server.

Hi,

I have same problem. But this is related with amavisd-new app. This error is delaying my in and outogintg emails. I have a fresh install and after making the first mail tests with success, itsuddenly started with this error. My amavisd-new cant’t start because of that.

Thanks

This comment has been deleted