Log Dejargonizer

UFW (Uncomplicated Firewall) · Event UFW BLOCK

UFW BLOCK: Ubuntu's firewall dropped a packet

UFW blocked a connection. It is the same netfilter logging underneath as raw iptables, just with a recognisable prefix — and on any machine reachable from the internet, the volume is normal and expected.

Also written as UFW BLOCKufw blocked log[UFW BLOCK] IN=ufw.log entries

What it means for you

On a personal computer

Ubuntu's firewall blocked something trying to reach your machine. This is the firewall doing its job. If you have a Raspberry Pi or a home server reachable from the internet, hundreds of these a day is completely normal.

For an analyst

UFW writes to /var/log/ufw.log by default on Ubuntu through an rsyslog rule, which keeps it out of the general kernel log. The prefix distinguishes BLOCK from ALLOW and AUDIT, and the logging level UFW is set to determines how much of that you actually see.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Aug 28 09:41:17 pi-01 kernel: [1234567.890123] [UFW BLOCK] IN=eth0 OUT= MAC=00:00:5e:00:53:01:00:00:5e:00:53:02:08:00 SRC=198.51.100.77 DST=192.0.2.15 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=41928 DF PROTO=TCP SPT=49820 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0

The fields that decide it

Everything else in the log line is context.

Prefix
Which UFW decision produced the entry.
  • [UFW BLOCK]The packet was dropped. The common case.
  • [UFW ALLOW]The packet was permitted, logged at higher logging levels.
  • [UFW AUDIT]Logged for inspection without a decision being recorded, at the highest logging level.
  • [UFW LIMIT BLOCK]Dropped by a rate limit rule rather than by a plain deny.
IN / OUT
Interfaces, giving the direction. Same semantics as raw iptables.
SRC / DST
Source and destination addresses.
DPT
Destination port — what was being reached for.
PROTO
The protocol.

Ordinary reasons this happens

Most of the time it is one of these.

  • Internet background scanning, which is nearly all of it on a public address.
  • Local network broadcast and multicast discovery, which fills the log on a home network.
  • mDNS, SSDP, and similar traffic from other devices on the same network.
  • A service you have not opened a port for yet.
  • IPv6 neighbour discovery, which surprises people who only configured IPv4 rules.

When it is not ordinary

Port scanning.

What gives it awayOne source against many destination ports in a short window.

ATT&CK T1046

A local process trying to reach out.

What gives it awayBlocks where IN is empty, meaning the packet originated on this machine.

ATT&CK T1071

Repeated attempts against a rate-limited service.

What gives it away[UFW LIMIT BLOCK] entries, which mean the rate limit is being hit rather than a plain deny.

ATT&CK T1110

What to do next

  1. Read the prefix to see which decision produced the entry.
  2. Read IN and OUT for direction. Outbound blocks matter more than inbound.
  3. Aggregate by source and destination port before judging anything.
  4. For local network noise, consider whether you need to log broadcast traffic at all.
  5. Lower the UFW logging level if the volume is unmanageable — `ufw logging low` keeps blocks and drops the rest.

Queries to run

grep 
grep 'UFW BLOCK' /var/log/ufw.log | grep -oP 'SRC=\K[\d.]+' | sort | uniq -c | sort -rn | head -20
grep Which ports are being probed most. 
grep 'UFW BLOCK' /var/log/ufw.log | grep -oP 'DPT=\K\d+' | sort -n | uniq -c | sort -rn | head -20
grep The current rule set and logging level, which is usually what you actually want to check. 
ufw status verbose

Common questions

Where is the UFW log file on Ubuntu?

/var/log/ufw.log by default, populated through an rsyslog rule that filters UFW's kernel messages into their own file. If it is empty, check that logging is enabled with `ufw status verbose` — `ufw logging on` turns it on.

Should I worry about lots of UFW BLOCK entries?

No, if they are inbound from the internet. Every publicly reachable address is scanned continuously, and each block means the firewall did what you configured it to do. Entries where the IN field is empty are different — those are packets your own machine tried to send, and those are worth understanding.

How do I reduce UFW log noise?

Lower the logging level with `ufw logging low`, which records blocked packets and drops the rest. On a home network, much of the volume is broadcast and multicast discovery from other devices, and a rule that drops that traffic without logging it removes most of the noise without losing anything useful.

Read next

Vendor documentation

Last reviewed 28 August 2026