ufw not working if you didn't reload nginx

aaP_lptrung

I used aaPanel version 7.0.8 on Ubuntu 22.04 and installed the Fail2ban plugin. I tried to ban an IP using Fail2ban and I felt like it worked.

Then I detected and tested the connection to my website from the banned IP but it worked fine. Then I tried to use command reload nginx "/etc/init.d/nginx reload" and the firewall ufw blocked that IP.

I tried to deny one IP manually using the ufw command "ufw insert 1 reject from x.x.x.x" and it also didn't work. Then I reload or restart nginx and my firewall worked fine.

I think this is a bug because when Fail2ban detected the IP blocking, the firewall added IP into list deny, but the firewall still didn't work if you didn't reload your nignx

aaPanel_Kern

Hello, Fail2ban reads the site log of nginx to block it, and it has nothing to do with whether nginx is reloaded.

aaP_lptrung

aaPanel_Kern Thank you for reply, so if i add ufw deny one IP by manually then i reload my nginx. and i think the plugin fail2ban couldn't auto banned

aaPanel_Kern

It is recommended that you check the settings of Fail2ban, which needs to be banned after a certain number of times.
Also check whether the site’s logs have corresponding IP addresses.

aaP_lptrung

aaPanel_Kern I thinks when I use the command "ufw insert 1 reject from x.x.x.x" to block access from a specific IP to a website, UFW will immediately apply the firewall rule without needing to restart or reload any other services including Nginx. I think some problem from aaPanel

aaPanel_Kern

It is recommended that you check the source IP of the website’s access log.
If a CDN reverse proxy or CloudFlare is used, ufw will not be able to recognize it.

aaP_lptrung

aaPanel_Kern I have 3 server install aaPanel (about 40 website) and i confirm that i don't use CDN reverse proxy or CloudFlare

aaPanel_Kern

Please check the website's access log to see if the IP has been added correctly.
Do you want to reload ufw after adding the ufw command?

aaP_lptrung