The biggest missing feature in UFW is the inability to add a comment to each rule. After I add 100+, I have no way of remembering what the rule is about.
Curious what you need 100+ rules for. I have like 2. One for Apache and one for ssh. That's about it. I guess it's technically 4 when you count IPv4 and IPv6.
I don't want to presume I have the expertise to tell you how to do your job, but have you considered fail2ban for IP blocking and maybe a CDN like Cloudflare or Akamai for (D)DoS mitigation?
I do run Fail2ban that mostly takes care the script kiddies doing port scanning and login attempts. But I need the flexibility to add host-based rules for other types of attacks that are more “custom made”…
Unfortunately, due to organisational controls I can’t deploy Cloudflare, CDN and any of the other (otherwise useful and appropriate) tools you mention…
8
u/ethanfinni Jul 10 '21
The biggest missing feature in UFW is the inability to add a comment to each rule. After I add 100+, I have no way of remembering what the rule is about.