ufw insert 1 / ufw prepend: put a deny rule before existing allow rules
- tool
- ufw
- command
- ufw
- flag
- insert NUM / prepend
- default
- new rules are appended after the existing ones
sudo ufw insert 1 deny from 203.0.113.7 adds the rule at position 1, ahead of all existing rules, and sudo ufw prepend deny from 203.0.113.7 adds it before all other rules of the same IP version. Both exist because ufw normally appends new rules, and rules are evaluated in order with the first match deciding. A deny appended after allow 80/tcp never blocks web traffic from that address; inserted at the top, it does.
Commands
sudo ufw status numbered # current order
sudo ufw insert 1 deny from 203.0.113.7 # block before anything else
sudo ufw insert 3 deny to any port 22 from 10.0.0.135 proto tcp # example from the manual
sudo ufw prepend deny from 2001:db8::7 # before every IPv6 ruleinsert NUM takes the position shown by ufw status numbered; the existing rule at that position and all later ones move down by one.
insert versus prepend versus append
| Form | Position | Notes |
|---|---|---|
| ufw deny ... (default) | After all existing rules | Fine for new allow rules, wrong for blocks |
| ufw insert NUM deny ... | At position NUM | NUM must be an existing position |
| ufw prepend deny ... | Before all rules of the same IP version | Recommended by the manual for dynamic blocks (IPS, scripts) |
The manual notes that prepended IPv4 rules go before all other IPv4 rules and IPv6 rules before all IPv6 rules. With insert, the numbering mixes both families in one list, so inserting an IPv4 rule at a position that belongs to the IPv6 section can fail or land where you did not expect.
Pitfalls
- Rule comments. A comment can be added with
comment 'reason'; the manual states thatinsertandprependcannot be used to update the comment of an existing rule. - Existing connections. A new deny rule affects new packets; established connections from the address may continue until they are closed, depending on rule order relative to the established-traffic rules in ufw's before chains.
- Rate limiting instead of blocking. For brute-force protection,
ufw limitis usually better than manual deny rules; see ufw limit for SSH. - Same logic in iptables. ufw's insert is the counterpart of iptables
-I; see iptables -I vs -A.
A complete walkthrough of blocking addresses is on block an IP address with ufw.
FAQ
Why does ufw deny from an address not block it?
ufw appends new rules at the end, and the first matching rule wins. If an earlier rule already allows the port (for example allow 80/tcp), the deny is never reached. Insert it at the top with ufw insert 1 deny from ADDRESS, or use ufw prepend.
What is the difference between insert 1 and prepend?
insert NUM places the rule at that position in the combined list. prepend adds it before all other rules of the same IP version, so an IPv4 rule goes before every IPv4 rule and an IPv6 rule before every IPv6 rule, which avoids mixing up the numbering of the two families.
Why does ufw insert fail with an invalid position?
The number must refer to an existing rule. On a ruleset with three rules, insert 5 is out of range; use status numbered to see the valid positions, or append the rule normally.