Hardening Linux Server Perimeters: Port Scanning, UFW Rules, and Fail2ban Setup

Introduction: The Hostile Internet Perimeter

Every public IPv4 address on the internet is scanned dozens of times per hour by automated botnets looking for unauthenticated databases, exposed administrative interfaces, and unpatched server daemons.

Leaving standard database ports like **MySQL (3306)**, **PostgreSQL (5432)**, or **Redis (6379)** open to the public internet (`0.0.0.0/0`) is an invitation to automated ransomware. Attackers use automated tools to connect to exposed databases, drop tables, and leave a ransom note demanding cryptocurrency payments for recovery.

---

1. Principles of Zero-Trust Perimeter Firewalls

A secure server architecture follows three fundamental rules: 1. **Default-Deny Inbound:** Drop all incoming network connections unless an explicit rule permits them. 2. **Expose Only What Citizen Traffic Requires:** In a standard web application, only **Port 80 (HTTP)** and **Port 443 (HTTPS)** should ever be accessible to the general public. 3. **Isolate Administration:** Management channels like SSH (Port 22) must be restricted to a private VPN or whitelisted administrative IP addresses.

---

2. Hardening with UFW (Uncomplicated Firewall)

On modern Ubuntu/Debian Linux distributions, UFW provides an intuitive interface over underlying Linux `iptables` and `nftables` packet filters.

# 1. Reset rules and enforce default policies
sudo ufw default deny incoming

# 2. Allow public web traffic sudo ufw allow 80/tcp comment 'Public HTTP redirect' sudo ufw allow 443/tcp comment 'Public HTTPS traffic'

# 3. Restrict SSH access strictly to your corporate/home IP address sudo ufw allow from 203.0.113.45 to any port 22 proto tcp comment 'Admin SSH'

# 4. Activate the firewall sudo ufw enable

# 5. Check active rules and status sudo ufw status verbose ```

---

3. Neutralizing Brute-Force Attacks with Fail2ban

If your administrators must access SSH without a static IP, install **Fail2ban**. It monitors system authentication logs (`/var/log/auth.log`) for repeated failed login attempts and dynamically injects temporary firewall drop rules against offending IP addresses:

# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 4
findtime = 600
bantime = 86400

---

4. Auditing Your External Perimeter

Once your firewall rules are active, verify that no unintended services are listening externally. Use our free [Perimeter Port Scanner](/tools/port-scanner) to run safe, non-destructive TCP SYN checks across your public hostname or IP address.