UFW Blocks SSH Access After Rule Changes on Ubuntu 14.04

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators lose SSH connectivity immediately after enabling or tightening UFW policy, risking extended outage and remote lockout.

Environment & Reproduction

Occurs on Ubuntu 14.04 when default incoming policy is set to deny without pre-adding allow rules for tcp/22 or custom SSH port.

Root Cause Analysis

Firewall policy order and interface scope do not permit management traffic, so established remote sessions drop and new sessions fail.

Quick Triage

From console, inspect ufw status numbered and iptables rules, confirm sshd is listening, and verify network path before modifying policy.

Step-by-Step Diagnosis

Check current SSH listen port in sshd_config, review UFW rule precedence, and test connection from trusted source while tailing auth and kernel logs.

Solution – Primary Fix

Add explicit allow rules for SSH from management CIDRs, reload UFW, and validate remote login before applying any broader deny defaults.

Solution – Alternative Approaches

Use raw iptables with change control, limit SSH by source addresses and fail2ban, or place bastion host in front of legacy trusty nodes.

Verification & Acceptance Criteria

SSH connects consistently from authorized networks, unauthorized attempts are blocked, and UFW status reflects intended numbered policy set.

Rollback Plan

Disable UFW temporarily from console if lockout persists, then reapply previously exported rule set with staged validation.

Prevention & Hardening

Always whitelist management access first, script preflight SSH checks, and require console fallback before remote firewall changes.

Related Errors & Cross-Refs

Can be mistaken for sshd failure, routing issues, or DNS problems; cross-check service status and network ACL layers.

Related tutorial: View the step-by-step tutorial for Ubuntu 14.04 LTS.

View all Ubuntu 14.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See ufw and iptables documentation, OpenSSH hardening guidance, and your organization firewall change policy.