IP traffic getting access even after blocking

Question

There are multiple access records like the example I've provided below indicating traffic is allowed through to my system even after I have run these commands to deny this traffic.

ufw deny from 78.128.113.58/24 to any //for ufw
ip route add unreachable 78.128.113 //for fail2ban

Access Record Example

78.128.113.62 - - [04/Jan/2020:19:59:33 +0530] "GET /efk-dashboard HTTP/1.1" 404 66914 "-" "python-requests/2.13.0"

I also restarted the fail2ban service after adding the IP address.

I've run out of ideas and wondering if someone can help me resolve?

Answer 1

Since firewall rules work on an order of precedent, it's likely that you have the deny rule that comes after some other rule that allows the traffic through and thus that traffic never hits the deny rule.

You can see the order of the rules by running ufw status numbered to confirm if that's the case.

To resolve you could try to delete the deny rule and then add it back with the specific NUM order position you need it to be so that traffic is denied before the allow rule allows it through.

---

To keep it simple, let's say your deny rule is number 5 and the allow rule letting it through before the deny is number 2. If that were the case, then run these commands to reorder properly...

ufw delete 5
ufw insert 1 deny 78.128.113.58/24 to any

This would put the deny rule above the allow rule and ensure the correlated traffic is denied before it hits the allow rule. Just be sure to check the ufw status numbered after you make adjustments to ensure the operation didn't move any other rules around improperly ordering them. It's be best to also be sure to have a backup of the configuration settings beforehand too just in case.

---

Supporting Resources

• Ubuntu Man Page: ufw - program for managing a netfilter firewall

     delete RULE|NUM
            deletes the corresponding RULE
  
     insert NUM RULE
            insert the corresponding RULE as rule number NUM
  

• UFW Firewall Rules ordering