Ubuntu 26.04 LTS – UFW policy change blocks SSH access – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote administration is lost after firewall rule changes, increasing outage duration and recovery risk.

Environment & Reproduction

Common after setting deny defaults before adding explicit SSH allow rules.

sudo ufw status verbose
ss -tulpen | grep :22
systemctl status ssh

Root Cause Analysis

UFW default deny and rule order conflicts block inbound SSH traffic.

Quick Triage

Check active firewall state and sshd listener.

sudo ufw status numbered
sudo iptables -S | head -n 80
sudo journalctl -u ssh -n 80 --no-pager

Step-by-Step Diagnosis

Identify missing SSH allows and confirm protocol/port alignment.

grep -RIn '^Port' /etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/null
sudo ufw status numbered
ss -ltnp | grep sshd

Solution – Primary Fix

Allow SSH before enforcing deny defaults, then reload firewall.

sudo ufw allow 22/tcp
sudo ufw reload
sudo ufw status verbose
sudo systemctl restart ssh

Solution – Alternative Approaches

Restrict SSH to trusted subnets while preserving administrative reachability.

sudo ufw delete allow 22/tcp || true
sudo ufw allow from 10.0.0.0/24 to any port 22 proto tcp
sudo ufw status numbered

Verification & Acceptance Criteria

SSH connects from approved networks and firewall policy remains least privilege.

sudo ufw status verbose
ssh -o BatchMode=yes localhost true
ss -tulpen | grep :22

Rollback Plan

Temporarily disable UFW from console if remote lockout recurs.

sudo ufw disable
sudo systemctl restart ssh
sudo ufw enable

Prevention & Hardening

Apply firewall changes through tested scripts with preflight connectivity checks.

sudo ufw status numbered
who
last -n 5

Related Errors & Cross-Refs

Often appears with sshd port changes, fail2ban rules, or cloud security-group misalignment.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu UFW and OpenSSH server hardening guidance.