Deploying an Arch Linux server in the cloud gives you absolute control over your environment, but out-of-the-box minimal installations leave your SSH port exposed to automated brute-force botnets.
To secure a cloud instance effectively, implementing a network firewall combined with an automated intrusion prevention system is essential. In this guide, we will configure Uncomplicated Firewall (UFW) and Fail2Ban on Arch Linux to lock down non-essential ports and automatically ban malicious IP addresses.
Prerequisites
*A running Arch Linux instance with sudo privileges.
*Basic familiarity with Systemd services (systemctl).
Step 1: Installing and Configuring UFW (Uncomplicated Firewall)
While Arch Linux defaults to iptables or nftables, UFW provides a manageable CLI interface to handle packet filtering without syntax overhead.
First, update your package database and install UFW:
sudo pacman -Syy ufw
Before enabling the firewall, always explicitly allow SSH traffic, otherwise you will immediately lock yourself out of your remote server.
Set default policies to deny incoming and allow outgoing traffic
sudo ufw default deny incoming
sudo ufw default allow outgoing
Allow SSH traffic (Port 22 or your custom SSH port)
sudo ufw allow 22/tcp
(Optional) Allow standard web traffic if running Nginx/Apache
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
Enable the UFW service and ensure it starts on system boot:
sudo ufw enable
sudo systemctl enable ufw
To verify active rules:
sudo ufw status verbose
Step 2: Preventing Brute-Force Attacks with Fail2Ban
While UFW restricts open ports, botnets can still spam your open SSH port with thousands of authentication attempts. Fail2Ban inspects log files (like journalctl) and alters UFW rules to dynamically ban offending IPs.
Install Fail2Ban via pacman:
sudo pacman -S fail2ban
Fail2Ban uses a local configuration file jail.local to override default settings safely. Create and edit this file:
sudo nano /etc/fail2ban/jail.local
Paste the following baseline security configuration:
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 3
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = systemd
Save the file, then enable and start the Fail2Ban service:
sudo systemctl enable --now fail2ban
Step 3: Monitoring Banned IPs and Testing
To verify that Fail2Ban is actively parsing logs and protecting your SSH daemon, check the status of the sshd jail:
sudo fail2ban-client status sshd
If an attacker fails 3 password attempts within 10 minutes, Fail2Ban automatically appends a temporary drop rule directly to your UFW engine. To manually unban an IP (e.g., if you accidentally lock yourself out from another network):
sudo fail2ban-client set sshd unbanip <TARGET_IP_ADDRESS>
Summary
Combining UFW's static packet filtering with Fail2Ban's dynamic log monitoring establishes a robust baseline defense for any Arch Linux cloud server. This layered approach stops port scanners and mitigates automated SSH attacks before they can consume system resources.
