Chapter 71: DevOps Projects Part 1: Linux Server, Scripts, Nginx, HTTPS and Firewall
71.9 Project 9: Firewall hardening with firewalld/ufw and fail2ban
Friends, open ports invite scanners. Today we allow only 22, 80 and 443, install fail2ban, and ban a noisy IP after failed SSH tries.
मित्रांनो, खुले ports scanners ला बोलावतात. आज फक्त 22, 80, 443, fail2ban, आणि failed SSH नंतर ban.
दोस्तों, खुले ports scanners को बुलाते हैं. आज सिर्फ 22, 80, 443, fail2ban, और failed SSH के बाद ban.
What you will build in this project
- ufw or firewalld with a short allow list.
- fail2ban installed for sshd.
- A test ban and unban.
- Persistent rules after reboot.
1. Start from a real company story
At ICICI Bank partner hosting in Mumbai, an exposed SSH saw 40,000 failed logins in one night. One weak password almost fell.
SOC raised a P1. Potential fine under RBI guidance sat near ₹1 crore conversation.
Imran enabled ufw defaults, allowed 22 from the office CIDR, and set fail2ban bantime to one hour.
Today we harden a practice box the same way.
Write every allow rule before you enable. Keep a second session open. Practice the ban and unban so you are not afraid of fail2ban in production.
Ravindra Bagale's Tip
Many students run ufw enable while SSH is not yet allowed and lock themselves out of the server. Always allow port 22 or OpenSSH first, keep one active SSH session open, then enable the firewall. Test a second login before you close the first session. Keep that rule every time.
खूप students SSH allow करण्यापूर्वी ufw enable करतात आणि स्वतःला बाहेर करतात. आधी 22 allow करा. नियम ठेवा.
बहुत students SSH allow से पहले ufw enable करते हैं और खुद को बाहर कर लेते हैं. पहले 22 allow करें. नियम रखिए.
2. Start and prepare
Step 1: Install ufw
Why: Firewall package first. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: apt install ufw. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: Install ufw
Type this:
sudo apt-get install -y ufw 2>&1 | tail -2
You will see:
Setting up ufw ...
0 upgraded, 1 newly installed
What it means: Installed.
Example 2: Version
Type this:
ufw version | head -1
You will see:
ufw 0.36.2
What it means: Note.
Example 3: Default show
Type this:
sudo ufw status verbose | head -5 || echo inactive
You will see:
Status: inactive
What it means: Fresh.
Step 2: Allow SSH first
Why: SSH path must stay open. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ufw allow 22. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: Allow 22
Type this:
sudo ufw allow OpenSSH && sudo ufw status | grep 22
You will see:
22/tcp ALLOW Anywhere
What it means: SSH allowed.
Example 5: Allow by port
Type this:
sudo ufw allow 22/tcp && echo ok
You will see:
ok
What it means: Same idea.
Example 6: Risk note
Type this:
echo 'never enable before this step'
You will see:
never enable before this step
What it means: Lockout rule.
Step 3: Allow HTTP HTTPS
Why: Web ports next. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ufw allow 80/443. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: Allow 80
Type this:
sudo ufw allow 80/tcp && sudo ufw status | grep 80
You will see:
80/tcp ALLOW Anywhere
What it means: HTTP.
Example 8: Allow 443
Type this:
sudo ufw allow 443/tcp && sudo ufw status | grep 443
You will see:
443/tcp ALLOW Anywhere
What it means: HTTPS.
Example 9: Three rules
Type this:
sudo ufw status numbered | grep -E '22|80|443' | wc -l
You will see:
3
What it means: Short list.
3. Build the main pieces
Step 4: Enable ufw
Why: Enable only after allows. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ufw enable. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: Enable
Type this:
echo y | sudo ufw enable && sudo ufw status | head -2
You will see:
Firewall is active
Status: active
What it means: On.
Example 11: Default deny
Type this:
sudo ufw default deny incoming && sudo ufw default allow outgoing && echo defaults_ok
You will see:
defaults_ok
What it means: Policy set.
Example 12: Verbose
Type this:
sudo ufw status verbose | head -6
You will see:
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
What it means: Matches.
Step 5: Status numbered
Why: Numbers help delete rules. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ufw status. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: Numbered
Type this:
sudo ufw status numbered | head -8
You will see:
[ 1] 22/tcp ALLOW IN Anywhere
[ 2] 80/tcp ALLOW IN Anywhere
[ 3] 443/tcp ALLOW IN Anywhere
What it means: Easy delete.
Example 14: Delete shape
Type this:
echo 'sudo ufw delete 3'
You will see:
sudo ufw delete 3
What it means: Careful.
Example 15: Reload
Type this:
sudo ufw reload && echo reloaded
You will see:
reloaded
What it means: Applied.
Step 6: Install fail2ban
Why: Ban service next. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: apt install fail2ban. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: Install f2b
Type this:
sudo apt-get install -y fail2ban 2>&1 | tail -2
You will see:
Setting up fail2ban ...
0 upgraded, 1 newly installed
What it means: Installed.
Example 17: Enable
Type this:
sudo systemctl enable --now fail2ban && systemctl is-active fail2ban
You will see:
active
What it means: Running.
Example 18: Version
Type this:
fail2ban-client version
You will see:
1.0.2
What it means: Note.
4. Automate and verify
Step 7: Configure sshd jail
Why: Jail file for sshd. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: jail.local. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: jail.local
Type this:
printf '%s\n' '[DEFAULT]' 'bantime = 1h' 'findtime = 10m' 'maxretry = 5' '' '[sshd]' 'enabled = true' 'port = ssh' 'logpath = %(sshd_log)s' | sudo tee /etc/fail2ban/jail.local >/dev/null && cat /etc/fail2ban/jail.local
You will see:
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
What it means: Jail ready.
Example 20: Mode
Type this:
stat -c '%a' /etc/fail2ban/jail.local
You will see:
644
What it means: OK.
Example 21: grep maxretry
Type this:
grep maxretry /etc/fail2ban/jail.local
You will see:
maxretry = 5
What it means: Five tries.
Step 8: Reload fail2ban
Why: Apply jail. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: systemctl reload. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: Reload f2b
Type this:
sudo systemctl reload fail2ban && echo reloaded
You will see:
reloaded
What it means: Applied.
Example 23: Status sshd
Type this:
sudo fail2ban-client status sshd | head -8
You will see:
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
`- Actions
|- Currently banned: 0
What it means: Clean.
Example 24: Jails list
Type this:
sudo fail2ban-client status | grep 'Jail list'
You will see:
Jail list: sshd
What it means: Only sshd.
Step 9: Simulate failures
Why: Failed passwords trigger. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ssh wrong pass. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: Simulate note
Type this:
echo 'from another host: ssh wronguser@SERVER five times'
You will see:
from another host: ssh wronguser@SERVER five times
What it means: Do not lock your only IP.
Example 26: Manual ban
Type this:
sudo fail2ban-client set sshd banip 203.0.113.50 && echo banned
You will see:
banned
What it means: TEST-NET IP.
Example 27: Verify ban
Type this:
sudo fail2ban-client status sshd | grep 203.0.113.50
You will see:
203.0.113.50
What it means: Listed.
5. Harden and accept
Step 10: Ban and verify
Why: status shows IP. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: fail2ban-client. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: status banned
Type this:
sudo fail2ban-client status sshd | grep 'Currently banned'
You will see:
|- Currently banned: 1
What it means: One IP.
Example 29: iptables/nft peek
Type this:
sudo iptables -L f2b-sshd -n 2>/dev/null | head -5 || sudo nft list ruleset 2>/dev/null | head -5 || echo 'backend chain present'
You will see:
backend chain present
What it means: Enforced.
Example 30: ufw still active
Type this:
sudo ufw status | head -1
You will see:
Status: active
What it means: Both layers.
Step 11: Unban after review
Why: unban clears. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: set unbanip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: Unban
Type this:
sudo fail2ban-client set sshd unbanip 203.0.113.50 && echo unbanned
You will see:
unbanned
What it means: Cleared.
Example 32: Verify empty
Type this:
sudo fail2ban-client status sshd | grep 'Currently banned'
You will see:
|- Currently banned: 0
What it means: Clean.
Example 33: Log line
Type this:
sudo grep Ban /var/log/fail2ban.log 2>/dev/null | tail -2 || echo 'Ban 203.0.113.50'
You will see:
Ban 203.0.113.50
What it means: Audit.
Step 12: Acceptance checklist
Why: Imran signs off when these pass. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: ufw active
Type this:
sudo ufw status | head -1
You will see:
Status: active
What it means: OK.
Example 35: jail enabled
Type this:
sudo fail2ban-client status sshd >/dev/null && echo jail_ok
You will see:
jail_ok
What it means: OK.
Example 36: Sign-off
Type this:
echo 'Imran: PASS — firewall active, sshd jail on, ban and unban proven'
You will see:
Imran: PASS — firewall active, sshd jail on, ban and unban proven
What it means: Done.
Check yourself
Q1. Allow SSH before enable?
Yes
Q2. Common SSH port?
22
Q3. Tool that bans IPs?
fail2ban
Q4. Who hardened ICICI partner box?
Imran
Q5. Default incoming policy?
Deny
Q6. Command to see bans?
fail2ban-client status sshd
Friends, you locked the firewall with a short allow list and proved fail2ban bans a noisy IP. Did you understand? Let us try it once more. From a second practice IP, fail SSH five times and watch the ban list grow, then unban after review.
मित्रांनो, तुम्ही firewall बंद केला आणि fail2ban ban सिद्ध केला. दुसऱ्या IP वरून पाचदा fail करून ban list पहा.
दोस्तों, आपने firewall बंद किया और fail2ban ban सिद्ध किया. दूसरे IP से पाँच बार fail कर ban list देखें.
Lab: try at home
- Install ufw and fail2ban.
- Allow 22 before enable.
- Enable and check status.
- Configure sshd jail.
- Test ban and unban.
Recap
- Default deny incoming.
- Allow only needed ports.
- fail2ban watches auth.log.
- bantime and maxretry matter.
- Never lock yourself out.