How to Set Up UFW Firewall & Fail2ban on Ubuntu VPS for Zero-Trust Security

The Constant Reality of Internet Port Scanners

Within seconds of provisioning a public IPv4 address on any cloud provider, automated botnets and malicious crawlers begin scanning ports 22 (SSH), 80 (HTTP), 3306 (MySQL), and 5432 (PostgreSQL). Leaving these ports open without rate limiting or intrusion prevention guarantees thousands of unauthorized authentication attempts every single day.

In this guide, we combine UFW (Uncomplicated Firewall) with Fail2ban to create an impenetrable, automated defense perimeter.

Phase 1: Establishing Strict UFW Firewall Rules

Default firewall rules should always follow a default-deny architecture where all incoming connections are blocked unless explicitly authorized.

# Reset UFW to pristine state
sudo ufw --force reset

# Set strict defaults
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Authorize your management SSH port (use 22 or your custom port)
sudo ufw allow 22/tcp comment "SSH Management"

# Authorize standard web traffic
sudo ufw allow 80/tcp comment "HTTP Traffic"
sudo ufw allow 443/tcp comment "HTTPS Encrypted Traffic"

# Enable the firewall
sudo ufw enable

# Inspect active status with numbering
sudo ufw status numbered

Phase 2: Installing and Configuring Fail2ban

Fail2ban is an intrusion prevention framework that inspects system log files (such as /var/log/auth.log) for failed login patterns and dynamically updates firewall packet rules to ban offenders.

sudo apt update
sudo apt install -y fail2ban

Never edit /etc/fail2ban/jail.conf directly because system updates will overwrite your changes. Instead, create a local override configuration:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Phase 3: Hardening the [DEFAULT] and [sshd] Jails

In /etc/fail2ban/jail.local, find the [DEFAULT] section and customize the ban parameters:

[DEFAULT]
# Whitelist your local home/office static IP so you never get locked out
ignoreip = 127.0.0.1/8 ::1 YOUR_HOME_STATIC_IP

# Ban time: 1 day (86400 seconds)
bantime = 86400

# Find time: Evaluation window of 10 minutes (600 seconds)
findtime = 600

# Max retries: 3 failed attempts within 10 minutes triggers an immediate ban
maxretry = 3

# Use UFW as the default banning action
banaction = ufw

Scroll down to the [sshd] section and ensure it is activated:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3

Phase 4: Starting Fail2ban and Monitoring Banned Bots

Enable and start the Fail2ban systemd service:

sudo systemctl enable --now fail2ban
sudo systemctl status fail2ban

Inspect the live status of your SSH jail to view actively banned malicious IPs:

sudo fail2ban-client status sshd

If you or a colleague ever trigger a ban accidentally, unban the IP address with:

sudo fail2ban-client set sshd unbanip 198.51.100.25

Frequently Asked Questions (FAQ)

Can Fail2ban protect Nginx and WordPress login forms?

Yes! Fail2ban includes pre-configured filters for Nginx HTTP authentication and WordPress xmlrpc attacks. You can enable [nginx-http-auth] and [nginx-botsearch] in jail.local to ban bots attacking web forms.

Does Fail2ban consume high CPU resources?

Fail2ban uses inotify to watch log updates asynchronously, consuming less than 0.5% CPU under standard conditions.