Context
You manage a Winheberg VPS and spotted a suspicious IP address in your logs? A bot spamming your contact form, a script trying to log in via SSH hundreds of times, or simply an unwanted visitor you want to keep out? Blocking an IP on your VPS is a simple and effective operation that takes less than a minute.
This guide walks you through the three most common methods for blocking an IP on a Linux VPS, depending on the firewall installed on your system.
Prerequisites
- An active Winheberg VPS with root SSH access
- The IP (or IP range) you want to block, identified in your logs
Which method should you choose based on your distribution?
The right tool depends on the firewall already installed on your VPS.
| Distribution | Recommended firewall |
|---|---|
| Ubuntu | UFW |
| Debian | UFW (installable) |
| AlmaLinux, Rocky Linux, Fedora | firewalld |
| All distributions, including Alpine | iptables |
- UFW is the default firewall on Ubuntu, and the simplest to use. It's also easy to install on Debian
- firewalld is the default firewall on AlmaLinux, Rocky Linux, and Fedora. It offers advanced zone-based management
- iptables is the low-level tool that works on every Linux distribution, including Alpine. It's the universal solution if you don't want to install an extra firewall
Use the firewall already installed on your system rather than stacking several. Mixing UFW with manual iptables rules can create conflicts that are hard to diagnose.
Block an IP based on your firewall
UFW (Uncomplicated Firewall) is by far the simplest solution. The syntax is clear and readable.
Install UFW (if not already done)
On Ubuntu, UFW is usually already installed. On Debian, add it with this command.
apt install ufw -y
Block a single IP
To block a specific IP address.
ufw deny from 203.0.113.42
Replace 203.0.113.42 with the IP you want to block. The rule applies immediately.
Block an entire IP range
If you want to block a whole block (for example, an entire range used by an attacker), use CIDR notation.
ufw deny from 203.0.113.0/24
This command blocks the 256 addresses from 203.0.113.0 to 203.0.113.255.
Block an IP on a specific port only
If you want to block an IP only for a specific service (for example, blocking SSH access but leaving port 80 open).
ufw deny from 203.0.113.42 to any port 22
Check active rules
To see all the UFW rules currently in place.
ufw status numbered
You'll see something like this.
Status: active
To Action From
-- ------ ----
[ 1] Anywhere DENY 203.0.113.42
[ 2] 22/tcp ALLOW Anywhere
Remove a blocking rule
To remove a rule, use its number.
ufw delete 1
Or directly by specifying the IP.
ufw delete deny from 203.0.113.42
firewalld is the default firewall in the Red Hat ecosystem. It works with zones and rich rules for IP filtering.
Block a single IP
To block an IP address with firewalld, you use a rich rule.
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.42" reject'
firewall-cmd --reload
The --permanent option makes the rule persist across reboots. firewall-cmd --reload applies the changes.
Block an entire IP range
To block a full CIDR block.
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" reject'
firewall-cmd --reload
Block an IP on a specific port only
To block an IP only on the SSH port (22).
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.42" port port="22" protocol="tcp" reject'
firewall-cmd --reload
Check active rules
To see all the rich rules currently in place.
firewall-cmd --list-rich-rules
Remove a blocking rule
To remove a rule, use --remove-rich-rule with the exact same syntax used to add it.
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="203.0.113.42" reject'
firewall-cmd --reload
reject sends an error packet back to the sender, while drop silently ignores the packets. drop is generally preferable against attackers, so you don't confirm to them that the port is filtered.
iptables is the low-level Linux firewall management tool. It works on every distribution with no extra install, except on Alpine where it needs to be installed.
On Alpine, install iptables
apk add iptables
Block a single IP
To block an incoming IP address.
iptables -A INPUT -s 203.0.113.42 -j DROP
The DROP action silently ignores packets coming from this IP. To send an error back to the sender, use REJECT instead.
Block an entire IP range
iptables -A INPUT -s 203.0.113.0/24 -j DROP
Block an IP on a specific port only
To block an IP only on the SSH port.
iptables -A INPUT -s 203.0.113.42 -p tcp --dport 22 -j DROP
Check active rules
iptables -L INPUT -n -v --line-numbers
You'll see something like this.
Chain INPUT (policy ACCEPT)
num pkts bytes target prot opt in out source destination
1 0 0 DROP all -- * * 203.0.113.42 0.0.0.0/0
Remove a blocking rule
To remove a rule, use its line number (visible with --line-numbers).
iptables -D INPUT 1
Make the rules persistent
By default, iptables rules are lost on reboot. To keep them, you need to save them.
On Debian and Ubuntu
apt install iptables-persistent -y
netfilter-persistent save
On AlmaLinux, Rocky Linux, and Fedora
If you're using iptables instead of firewalld, install the save service.
dnf install iptables-services -y
service iptables save
On Alpine Linux
/etc/init.d/iptables save
rc-update add iptables
If you don't save the rules, your blocks will disappear on the VPS's next reboot.
How do you find the IP to block?
Before blocking an IP, you first need to know which one to block. Here are the most common sources.
In the SSH logs
To see recent SSH connection attempts and identify malicious IPs.
# Debian, Ubuntu
journalctl -u ssh -n 100 | grep "Failed password"
# AlmaLinux, Rocky, Fedora
journalctl -u sshd -n 100 | grep "Failed password"
# Alpine
tail -n 100 /var/log/messages | grep "Failed password"
In a web server's logs
To identify IPs spamming your site (Nginx as an example).
tail -n 1000 /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head
This command shows the 10 most active IPs over the last 1000 requests. An IP showing up hundreds of times is likely a bot or an attacker.
Checking an IP's reputation
Before blocking, you can check an IP's reputation on online services like AbuseIPDB or VirusTotal. If the IP has been reported by many users, blocking it is generally justified.
These services aren't foolproof. An IP can be wrongly flagged, or may have been used by an attacker in the past and later reassigned to a legitimate user (a common case with dynamic ISP IPs, shared VPNs, or Tor exit nodes). Before blocking an entire range, check your own logs to confirm the IP actually shows suspicious behavior on your end. Don't rely solely on AbuseIPDB to decide on a block.
A more automated approach, CrowdSec
If you want to automatically block IPs attacking your server, without having to hunt them down by hand, we recommend installing CrowdSec. It analyzes logs in real time, detects malicious behavior, and blocks IPs automatically. It's also a modern alternative to Fail2Ban.
To learn more, check our guide on securing a Linux VPS, which covers the full CrowdSec installation.
Need help?
If you accidentally blocked your own IP (yes, it happens 😅) and can no longer connect to your VPS, our team is here. Open a ticket in the Technical department from your client area and fill in the Related Product field with the VPS in question, we can help you access your server through the rescue console to undo the block.
You now know how to block an IP on your Linux VPS, whatever your system 🛡️
