Linux Firewall UFW don't block all IP adresses you have selected to Block.

[anprdev]

On my Blues/Rock Server I had some strange behave. Somebody connect and disconnect again very fast.
Maybe some Ping or somebody is testing something.

Trouble I get from this is that my Server sometimes crash.
So I was searching what I can do with this.
Only option was UFW Firewall but it had no effect. Fast Connection and disconnections still there.

After very much searching how to fix this. Why is it still possible that the Linux Firewall ufw don't block some IP Addresses.
If this is the case, it is possible to block them with a little tweak.

What you need is to edit before.rules from the Firewall.
Command on Raspberry PI
sudo nano /etc/ufw/before.rules
Near the top you find *filter there you add the ip address you like to Drop.
I block the IP tracking user data. More info about this see https://jamulusjams.com/block-user-tracking.html
-A ufw-before-input -s 137.184.43.255 -j DROP
-A ufw-before-forward -s 137.184.43.255 -j DROP
-A ufw-before-output -d 137.184.43.255 -j DROP

After add this and save you have to restart the firewall
sudo ufw disable
And restart
sudo ufw enable

That's it and problem is solved.

My Filter part

Don't delete these required lines, otherwise there will be errors

*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
-A ufw-before-input -s 137.184.43.255 -j DROP
-A ufw-before-forward -s 137.184.43.255 -j DROP
-A ufw-before-output -d 137.184.43.255 -j DROP

End required lines

[ann0see]

Why does your server crash?

[anprdev]

Why does your server crash?

See message below

[rdica]

I believe those quick connections are reads of Welcome message to determine if your server is capable of RAW audio.

Check your logs for 77.189.114.237 162.55.61.86 139.144.151.196 137.184.43.255. I see these in my logs on a regular basis.

Three Jamulus website operators are querying servers to find RAW audio-supported servers. These connections should be harmless on their own but if you're processing all connection types for your bot that may be a problem for you.

[anprdev]

I believe so. I no longer see OUTPUT rule packet counter incrementing on the rule with 134.199.209.51. Now I see packet counters incrementing for OUTPUT rule using 137.184.43.255.

I have not seen the IP yet in the Jamulus Server Log what is good I think.

[rdica]

You won't see it in server log. It's not INPUT traffic, you'd have to add a rule to output chain to drop.

[anprdev]

You won't see it in server log. It's not INPUT traffic, you'd have to add a rule to output chain to drop.

I don't get this how. Lost in translation.

[rdica]

If you're satisfied with your results please disregard my last response, it's a separate issue still under investigation.

[anprdev]

I will at the moment all is ok.
Thanks

[anprdev]

I have edit the text add also output blocking and the URL https://jamulusjams.com/block-user-tracking.html for more info.
@rdica @ann0see