> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Fix Being Locked Out of SSH After a Firewall Change

> Locked out of SSH after ufw enable or a firewall change? Log in on the VNC console, allow SSH with ufw allow OpenSSH or firewall-cmd, then test again.

If SSH stopped working right after `ufw enable` or another firewall change, the firewall now blocks your SSH port. Log in through the VNC console in the VPS Panel, allow SSH with `sudo ufw allow OpenSSH` (Ubuntu/Debian) or `sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload` (AlmaLinux/Rocky), and connect again. Use your custom port number instead if you changed it.

```text theme={null}
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
...
ssh: connect to host 203.0.113.10 port 22: Connection timed out
```

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 5 to 10 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | VNC console, root or sudo password |

## Before you start

* You need a way in that doesn't use the network. On a VPS that is the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md). On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) for KVM/IPMI access.
* The console asks for a password. If you only ever used SSH keys, [reset the root password](https://help.freakhosting.com/portals/vps-panel/how-to-reset-your-vps-root-password.md) first.
* Commands use `sudo`. As root, leave it out.

## Step 1: Log in on the console

Open the VNC console, click inside it and log in as `root` or your sudo user. Use the console's **Clipboard > Type** button to paste long commands.

## Step 2: Allow SSH again

Find your SSH port first if you aren't sure:

```bash theme={null}
sudo ss -tlnp | grep -E 'sshd|systemd'
```

Then use the tab for your firewall:

> [tab] UFW (Ubuntu / Debian)
>
> ```bash theme={null}
> sudo ufw allow OpenSSH
> sudo ufw status
> ```
>
> `OpenSSH` opens port 22. For a custom port, use `sudo ufw allow 2222/tcp`.

> [tab] firewalld (AlmaLinux / Rocky)
>
> ```bash theme={null}
> sudo firewall-cmd --permanent --add-service=ssh
> sudo firewall-cmd --reload
> sudo firewall-cmd --list-all
> ```
>
> For a custom port, use `--add-port=2222/tcp` instead of `--add-service=ssh`.

> [tab] iptables / nftables
>
> Put an allow rule at the top of the input chain:
>
> ```bash theme={null}
> sudo iptables -I INPUT -p tcp --dport 22 -j ACCEPT
> ```
>
> This lasts until reboot. Save it the way you load your rules, for example `sudo netfilter-persistent save` if you use `iptables-persistent`.

## Step 3: Test from a new terminal

Keep the console open and connect from your computer:

```bash theme={null}
ssh alex@203.0.113.10
```

If it works, you're done. If it still times out, go to Step 4.

## Step 4: Still locked out? Turn the firewall off temporarily

> [tab] UFW
>
> ```bash theme={null}
> sudo ufw disable
> ```

> [tab] firewalld
>
> ```bash theme={null}
> sudo systemctl stop firewalld
> ```

> [tab] iptables / nftables
>
> ```bash theme={null}
> sudo iptables -P INPUT ACCEPT
> sudo iptables -F
> ```
>
> On nftables-only systems, `sudo nft flush ruleset` removes all rules.

> [!WARNING]
>
> With the firewall off, every port is open. Only do this to get back in, then set up your rules again right away, starting with the SSH rule.

If SSH works with the firewall off, the rules were the problem: rebuild them with [UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md) or [firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md). If SSH still fails, the firewall wasn't the cause: check the rules in our [Firewall panel](https://help.freakhosting.com/portals/firewall/firewall-panel-overview.md), whether [Fail2ban banned your IP](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md), and see [SSH connection timed out](https://help.freakhosting.com/portals/other/how-to-fix-ssh-connection-timed-out.md).

## How to avoid locking yourself out next time

* **Allow SSH before you enable the firewall.** UFW warns `Command may disrupt existing ssh connections` for exactly this reason.
* **Keep your current session open** and test in a second one before you log out.
* **Test firewalld rules without `--permanent` first.** Runtime-only rules disappear on `firewall-cmd --reload` or a reboot, so a reboot from the panel undoes a mistake.
* **Use `iptables-apply`** for iptables rule files. It rolls the change back if you don't confirm within a timeout.
* **Write down your SSH port** if it isn't 22.

## How to check it worked

```bash theme={null}
sudo ufw status
```

```text theme={null}
Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)
```

On firewalld, `sudo firewall-cmd --list-services` should include `ssh`.

## Frequently asked questions

### Will rebooting the server remove the bad rule?

Not for UFW or saved firewalld rules: they load again at boot. Only runtime-only firewalld rules and unsaved iptables rules disappear.

### What if I can't log in on the console either?

Reset the password from the panel and try again. If that doesn't help, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) and say which firewall command you ran.

### Does `ufw reset` help?

It turns UFW off and deletes all rules, so SSH works again. You then have to add every rule again, so prefer `ufw allow OpenSSH`.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> Firewall rules on Ubuntu and Debian.

> [card] [Set up firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md)
>
> Firewall rules on AlmaLinux and Rocky.

> [card] [nftables and iptables](https://help.freakhosting.com/portals/other/how-to-use-nftables-and-iptables.md)
>
> Rules without a front end.

> [card] [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md)
>
> Your way in when SSH is blocked.

***

> [!NOTE]
>
> **Checked against the official [Ubuntu firewall documentation](https://ubuntu.com/server/docs/how-to/security/firewalls/), the [firewalld documentation](https://firewalld.org/documentation/) and the [iptables-apply manual](https://man7.org/linux/man-pages/man8/iptables-apply.8.html)** on 4 November 2026; the UFW warning text (ufw 0.36.2 source), the UFW commands (dry run) and the iptables and nftables commands (in an isolated network namespace) were tested on Ubuntu 24.04 LTS. The firewalld commands were not tested.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.