Skip to main content
If SSH stopped working right after ufw enable or another firewall change, the firewall now blocks your SSH port. Log in through the VNC console in the VPS Panel, allow SSH with sudo ufw allow OpenSSH (Ubuntu/Debian) or sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload (AlmaLinux/Rocky), and connect again. Use your custom port number instead if you changed it.

​
Before you start

  • You need a way in that doesn’t use the network. On a VPS that is the VNC console. On a dedicated server, open a ticket for KVM/IPMI access.
  • The console asks for a password. If you only ever used SSH keys, reset the root password first.
  • Commands use sudo. As root, leave it out.

​
Step 1: Log in on the console

Open the VNC console, click inside it and log in as root or your sudo user. Use the console’s Clipboard > Type button to paste long commands.

​
Step 2: Allow SSH again

Find your SSH port first if you aren’t sure:
Then use the tab for your firewall:
OpenSSH opens port 22. For a custom port, use sudo ufw allow 2222/tcp.

​
Step 3: Test from a new terminal

Keep the console open and connect from your computer:
If it works, you’re done. If it still times out, go to Step 4.

​
Step 4: Still locked out? Turn the firewall off temporarily

With the firewall off, every port is open. Only do this to get back in, then set up your rules again right away, starting with the SSH rule.
If SSH works with the firewall off, the rules were the problem: rebuild them with UFW or firewalld. If SSH still fails, the firewall wasn’t the cause: check the rules in our Firewall panel, whether Fail2ban banned your IP, and see SSH connection timed out.

​
How to avoid locking yourself out next time

  • Allow SSH before you enable the firewall. UFW warns Command may disrupt existing ssh connections for exactly this reason.
  • Keep your current session open and test in a second one before you log out.
  • Test firewalld rules without --permanent first. Runtime-only rules disappear on firewall-cmd --reload or a reboot, so a reboot from the panel undoes a mistake.
  • Use iptables-apply for iptables rule files. It rolls the change back if you don’t confirm within a timeout.
  • Write down your SSH port if it isn’t 22.

​
How to check it worked

On firewalld, sudo firewall-cmd --list-services should include ssh.

​
Frequently asked questions

​
Will rebooting the server remove the bad rule?

Not for UFW or saved firewalld rules: they load again at boot. Only runtime-only firewalld rules and unsaved iptables rules disappear.

​
What if I can’t log in on the console either?

Reset the password from the panel and try again. If that doesn’t help, open a ticket and say which firewall command you ran.

​
Does ufw reset help?

It turns UFW off and deletes all rules, so SSH works again. You then have to add every rule again, so prefer ufw allow OpenSSH.

VPS and dedicated server guides

Every guide in this section.

Set up UFW

Firewall rules on Ubuntu and Debian.

Set up firewalld

Firewall rules on AlmaLinux and Rocky.

nftables and iptables

Rules without a front end.

VNC console

Your way in when SSH is blocked.
Checked against the official Ubuntu firewall documentation, the firewalld documentation and the iptables-apply manual on 4 November 2026; the UFW warning text (ufw 0.36.2 source), the UFW commands (dry run) and the iptables and nftables commands (in an isolated network namespace) were tested on Ubuntu 24.04 LTS. The firewalld commands were not tested.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026