UFW‌ Blocks some IPs which are trying to attempt a connection to the server. I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming in past 24hrs.

Sample Log:

[UFW BLOCK] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=189.173.30.x DST=xx:xx:xx:xx LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=52308 DF PROTO=TCP SPT=52572 DPT=1557 WINDOW=1445 RES=0x00 ACK FIN URGP=0

What are my questions

1. Is the server under attack?

2. If yes,How does UFW‌ distinguish dangerous IPs normal ones?

3. What should i do for greater security?

UFW‌ Blocks some IPs which are trying to attempt a connection to the server. I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming in past 24hrs.

Sample Log:

[UFW BLOCK] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=189.173.30.x DST=xx:xx:xx:xx LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=52308 DF PROTO=TCP SPT=52572 DPT=1557 WINDOW=1445 RES=0x00 ACK FIN URGP=0

What are my questions

1. Is the server under attack?

2. If yes,How does UFW‌ distinguish dangerous IPs from normal ones?

3. What should i do for greater security?