--- title: "How to Block an IP Address on Your Linux VPS" description: "Block an IP address on your Winheberg VPS with UFW, firewalld, or iptables depending on your distribution, and learn how to identify suspicious IPs." category: vps subcategory: vps-linux icon: tabler:file-text date: 2026-07-24 author: Winheberg slug: "block-ip-linux-vps" order: 14 image: /statics/images/docs/en/vps-linux/block-ip-linux-vps.webp tags: [vps, security, ufw, firewalld, iptables] keywords: [block ip vps, ufw block ip address, firewalld rich rule, iptables drop ip, linux vps security] link_fr: "/docs/vps-linux/bloquer-ip-vps-linux" --- ## Context You manage a **Winheberg VPS** and spotted a suspicious IP address in your logs? A bot spamming your contact form, a script trying to log in via SSH hundreds of times, or simply an unwanted visitor you want to keep out? Blocking an IP on your VPS is a **simple and effective** operation that takes less than a minute. This guide walks you through the three most common methods for blocking an IP on a Linux VPS, depending on the firewall installed on your system. ## Prerequisites - An active **Winheberg VPS** with root SSH access - The IP (or IP range) you want to block, identified in your logs ## Which method should you choose based on your distribution? The right tool depends on the firewall already installed on your VPS. ::MdTable{caption="Recommended firewall by distribution" variant="default" striped} | Distribution | Recommended firewall | |---|---| | Ubuntu | UFW | | Debian | UFW (installable) | | AlmaLinux, Rocky Linux, Fedora | firewalld | | All distributions, including Alpine | iptables | :: - **UFW** is the default firewall on **Ubuntu**, and the simplest to use. It's also easy to install on Debian - **firewalld** is the default firewall on **AlmaLinux, Rocky Linux, and Fedora**. It offers advanced zone-based management - **iptables** is the low-level tool that works **on every Linux distribution**, including **Alpine**. It's the universal solution if you don't want to install an extra firewall > [!TIP] > Use the firewall already installed on your system rather than stacking several. Mixing UFW with manual iptables rules can create conflicts that are hard to diagnose. ## Block an IP based on your firewall :::MdTabs ::MdTab{label="UFW (Ubuntu, Debian)"} UFW (*Uncomplicated Firewall*) is by far the simplest solution. The syntax is clear and readable. ### Install UFW (if not already done) On Ubuntu, UFW is usually already installed. On Debian, add it with this command. ```bash apt install ufw -y ``` ### Block a single IP To block a specific IP address. ```bash ufw deny from 203.0.113.42 ``` Replace `203.0.113.42` with the IP you want to block. The rule applies immediately. ### Block an entire IP range If you want to block a whole block (for example, an entire range used by an attacker), use CIDR notation. ```bash ufw deny from 203.0.113.0/24 ``` This command blocks the 256 addresses from `203.0.113.0` to `203.0.113.255`. ### Block an IP on a specific port only If you want to block an IP only for a specific service (for example, blocking SSH access but leaving port 80 open). ```bash ufw deny from 203.0.113.42 to any port 22 ``` ### Check active rules To see all the UFW rules currently in place. ```bash ufw status numbered ``` You'll see something like this. ``` Status: active To Action From -- ------ ---- [ 1] Anywhere DENY 203.0.113.42 [ 2] 22/tcp ALLOW Anywhere ``` ### Remove a blocking rule To remove a rule, use its number. ```bash ufw delete 1 ``` Or directly by specifying the IP. ```bash ufw delete deny from 203.0.113.42 ``` :: ::MdTab{label="firewalld (AlmaLinux, Rocky, Fedora)"} firewalld is the default firewall in the Red Hat ecosystem. It works with zones and rich rules for IP filtering. ### Block a single IP To block an IP address with firewalld, you use a rich rule. ```bash firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.42" reject' firewall-cmd --reload ``` The `--permanent` option makes the rule persist across reboots. `firewall-cmd --reload` applies the changes. ### Block an entire IP range To block a full CIDR block. ```bash firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" reject' firewall-cmd --reload ``` ### Block an IP on a specific port only To block an IP only on the SSH port (22). ```bash firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.42" port port="22" protocol="tcp" reject' firewall-cmd --reload ``` ### Check active rules To see all the rich rules currently in place. ```bash firewall-cmd --list-rich-rules ``` ### Remove a blocking rule To remove a rule, use `--remove-rich-rule` with the exact same syntax used to add it. ```bash firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="203.0.113.42" reject' firewall-cmd --reload ``` > [!TIP] > `reject` sends an error packet back to the sender, while `drop` silently ignores the packets. `drop` is generally preferable against attackers, so you don't confirm to them that the port is filtered. :: ::MdTab{label="iptables (all distributions, including Alpine)"} `iptables` is the low-level Linux firewall management tool. It works on every distribution with no extra install, except on Alpine where it needs to be installed. ### On Alpine, install iptables ```bash apk add iptables ``` ### Block a single IP To block an incoming IP address. ```bash iptables -A INPUT -s 203.0.113.42 -j DROP ``` The `DROP` action silently ignores packets coming from this IP. To send an error back to the sender, use `REJECT` instead. ### Block an entire IP range ```bash iptables -A INPUT -s 203.0.113.0/24 -j DROP ``` ### Block an IP on a specific port only To block an IP only on the SSH port. ```bash iptables -A INPUT -s 203.0.113.42 -p tcp --dport 22 -j DROP ``` ### Check active rules ```bash iptables -L INPUT -n -v --line-numbers ``` You'll see something like this. ``` Chain INPUT (policy ACCEPT) num pkts bytes target prot opt in out source destination 1 0 0 DROP all -- * * 203.0.113.42 0.0.0.0/0 ``` ### Remove a blocking rule To remove a rule, use its line number (visible with `--line-numbers`). ```bash iptables -D INPUT 1 ``` ### Make the rules persistent By default, iptables rules are lost on reboot. To keep them, you need to save them. **On Debian and Ubuntu** ```bash apt install iptables-persistent -y netfilter-persistent save ``` **On AlmaLinux, Rocky Linux, and Fedora** If you're using iptables instead of firewalld, install the save service. ```bash dnf install iptables-services -y service iptables save ``` **On Alpine Linux** ```bash /etc/init.d/iptables save rc-update add iptables ``` > [!IMPORTANT] > If you don't save the rules, your blocks will disappear on the VPS's next reboot. :: ::: ## How do you find the IP to block? Before blocking an IP, you first need to know which one to block. Here are the most common sources. ### In the SSH logs To see recent SSH connection attempts and identify malicious IPs. ```bash # Debian, Ubuntu journalctl -u ssh -n 100 | grep "Failed password" # AlmaLinux, Rocky, Fedora journalctl -u sshd -n 100 | grep "Failed password" # Alpine tail -n 100 /var/log/messages | grep "Failed password" ``` ### In a web server's logs To identify IPs spamming your site (Nginx as an example). ```bash tail -n 1000 /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head ``` This command shows the 10 most active IPs over the last 1000 requests. An IP showing up hundreds of times is likely a bot or an attacker. ### Checking an IP's reputation Before blocking, you can check an IP's reputation on online services like [AbuseIPDB](https://www.abuseipdb.com/) or [VirusTotal](https://www.virustotal.com/). If the IP has been reported by many users, blocking it is generally justified. > [!WARNING] > These services aren't foolproof. An IP can be wrongly flagged, or may have been used by an attacker in the past and later reassigned to a legitimate user (a common case with dynamic ISP IPs, shared VPNs, or Tor exit nodes). Before blocking an entire range, check your own logs to confirm the IP actually shows suspicious behavior on your end. Don't rely solely on AbuseIPDB to decide on a block. ## A more automated approach, CrowdSec If you want to automatically block IPs attacking your server, without having to hunt them down by hand, we recommend installing **CrowdSec**. It analyzes logs in real time, detects malicious behavior, and blocks IPs automatically. It's also a modern alternative to Fail2Ban. To learn more, check our guide on securing a Linux VPS, which covers the full CrowdSec installation. ## Need help? If you accidentally blocked your own IP (yes, it happens 😅) and can no longer connect to your VPS, our team is here. Open a ticket in the **Technical** department from your client area and fill in the **Related Product** field with the VPS in question, we can help you access your server through the rescue console to undo the block. You now know how to block an IP on your Linux VPS, whatever your system 🛡️