How to Block an IP Address on Linux Server

You can block an IP address at the server firewall or at the web server. A firewall rule can restrict access to server services; an Apache or Nginx rule applies to the website or location where it is configured. Choose the layer that matches the traffic you need to stop.

Before You Start

• Use a sudo-capable account for firewall and web-server configuration. Keep the current SSH session open and have a working console or recovery route.
• Identify the actual client address from reliable logs. Do not block your administrator address, monitoring service, reverse proxy or CDN. A shared public IP may belong to several legitimate users.
• The addresses 203.0.113.45, 203.0.113.0/24 and 2001:db8::45 below are documentation examples. Replace them with the verified address or network.
• Save the current configuration and change one layer at a time. Do not mix UFW, firewalld and direct firewall rules without understanding how they interact.

Block an IP with UFW

These commands use Ubuntu’s UFW firewall. First inspect its status and rule order:

sudo ufw status verbose
sudo ufw status numbered

Continue only if UFW is the active firewall. If it is inactive, do not enable it remotely until the actual SSH port and all required services are allowed and recovery access is available. The rule below goes before existing user rules, so an earlier broad allow rule does not take precedence:

sudo ufw insert 1 deny from 203.0.113.45
sudo ufw status numbered

To restrict only web traffic from that address, use port-specific rules instead of the all-service rule above:

sudo ufw insert 1 deny from 203.0.113.45 to any port 80 proto tcp
sudo ufw insert 1 deny from 203.0.113.45 to any port 443 proto tcp

For a verified network range or IPv6 address, the same syntax accepts CIDR notation or IPv6. IPv6 filtering requires IPv6 support to be enabled in the UFW configuration:

sudo ufw insert 1 deny from 203.0.113.0/24
sudo ufw insert 1 deny from 2001:db8::45

Review a range before blocking it. These examples affect new traffic that reaches UFW; existing connections, Docker-published ports and other networking arrangements can require separate checks. If a CDN proxies the site, the host may see the CDN address instead of the visitor’s address.

Block an IP in Apache 2.4

For website-only filtering, Apache 2.4 uses Require directives. Add this to the relevant directory configuration, or to .htaccess only if the host permits the required overrides. Merge it with existing authorization rules rather than replacing them blindly:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.45
</RequireAll>

A denied website request should return HTTP 403. This does not block SSH or other services. The old Order, Allow and Deny examples belong to legacy access-control configuration and should not be mixed with this example.

When changing the main Apache configuration on Ubuntu, validate it before reloading:

sudo apachectl configtest
sudo systemctl reload apache2

Run the reload only after the test reports success. For an .htaccess change, test an actual request and check the error log as well; a main-configuration test does not validate every per-directory .htaccess file.

Block an IP in Nginx

Nginx does not read .htaccess files. Add access-control directives to the existing server or location that handles the request. Order matters: place the deny before a matching allow rule. Preserve the existing application configuration:

deny 203.0.113.45;
allow all;

Check syntax, then reload only if the test succeeds:

sudo nginx -t
sudo systemctl reload nginx

A request reaching that Nginx context from the denied address should return 403. Behind a trusted reverse proxy, configure real-client-IP handling correctly before relying on client-IP rules; do not trust arbitrary forwarded headers.

Verify and Remove a Block

• Use a separate test connection from the blocked address and confirm that an allowed connection still works. A test from your own allowed address cannot prove the block.
• Review firewall rules and the relevant service logs. A firewall drop and a web-server 403 are different results; an existing connection may remain open.
• Record the address, reason, rule scope and review date. IP addresses can be reassigned, so remove stale blocks.

To undo the all-service UFW example, delete the matching rule:

sudo ufw delete deny from 203.0.113.45

If you used the port-specific examples, remove each matching rule instead:

sudo ufw delete deny from 203.0.113.45 to any port 80 proto tcp
sudo ufw delete deny from 203.0.113.45 to any port 443 proto tcp

Remove range or IPv6 rules using the corresponding address and the same delete deny from syntax. For Apache or Nginx, remove the specific restriction, validate any server configuration changes and reload as appropriate. Retest both denied and allowed paths.

Keep IP Blocking Part of a Wider Security Plan

Manual IP rules do not expire automatically. A configured tool such as Fail2Ban can apply temporary bans based on matching logs, but it needs the correct filters and ban duration. Broad network or country blocks can also exclude legitimate visitors. Combine targeted blocking with updates, strong authentication, monitoring and backups.

FAQ