ufw-blocklist enhances the Ubuntu ufw firewall by integrating a daily-updated IP blocklist using ipsets for efficient network traffic blocking.
IP blocklist extension for Ubuntu ufw firewall
This tool is designed for Ubuntu users who want to automatically block malicious or unwanted IP addresses at the firewall level, particularly on systems exposed to the internet such as home gateways or public servers. It is ideal for administrators seeking a low-maintenance, resource-efficient solution to reduce unsolicited inbound, outbound, and forwarded traffic.
This tool requires Ubuntu with ufw and ipset installed and is best suited for systems with public IP exposure. It is designed to be low maintenance with daily automatic updates via a cron job. Users should backup original ufw configuration files before installation. The blocklist can be manually flushed and modified for testing, but regular updates should be managed via the provided cron script to maintain effectiveness.
Install the ipset package: sudo apt install ipset
Backup the original ufw after.init script: sudo cp /etc/ufw/after.init /etc/ufw/after.init.orig
Clone the ufw-blocklist repository: git clone https://github.com/poddmo/ufw-blocklist.git
Change directory to the cloned repo: cd ufw-blocklist
Copy after.init to ufw directory: sudo cp after.init /etc/ufw/after.init
Copy the cron job script: sudo cp ufw-blocklist-ipsum /etc/cron.daily/ufw-blocklist-ipsum
Set ownership to root: sudo chown root:root /etc/ufw/after.init /etc/cron.daily/ufw-blocklist-ipsum
Set permissions: sudo chmod 750 /etc/ufw/after.init /etc/cron.daily/ufw-blocklist-ipsum
Download initial IP blocklist: curl -sS -f --compressed -o ipsum.4.txt 'https://raw.githubusercontent.com/stamparm/ipsum/master/levels/4.txt'
Set permissions on the blocklist file: sudo chmod 640 ipsum.4.txtsudo /etc/ufw/after.init start
Starts the ufw-blocklist service and loads the IP blocklist into ipset.
sudo /etc/ufw/after.init status
Displays the current blocklist entry count, firewall hit counts, and recent log entries.
sudo /etc/ufw/after.init flush-all
Deletes all entries from the blocklist and resets iptables hit counters.
sudo ipset add ufw-blocklist-ipsum a.b.c.d
Manually adds a specific IP address to the blocklist for testing or immediate blocking.
sudo ipset list ufw-blocklist-ipsum -terse | grep 'Number of entries'
Monitors the progress of loading blocklist entries into the ipset.