UFW Blocking SSH or Required Service Ports

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote access fails after enabling ufw; SSH and app traffic are dropped.

Environment & Reproduction

Typical after `ufw enable` without pre-defined allow rules or with wrong interface/source constraints.

Root Cause Analysis

Default deny policy blocks inbound traffic when explicit allow entries are missing or ordered incorrectly.

Quick Triage

Use console access to avoid lockout while adjusting firewall policy.

Step-by-Step Diagnosis

Check `sudo ufw status numbered`, `ss -tulpen` for listening services, and relevant logs in `journalctl -k`.

Solution – Primary Fix

Add precise allow rules (e.g., `ufw allow OpenSSH`), verify source CIDRs, then reload ufw and retest connectivity.

Solution – Alternative Approaches

Temporarily disable ufw during emergency restoration, then reapply a reviewed baseline policy.

Verification & Acceptance Criteria

SSH and required services are reachable while unexpected ports remain blocked.

Rollback Plan

`ufw reset` to known baseline or restore rule export from backup.

Prevention & Hardening

Apply allow rules before enablement and maintain infrastructure-as-code for firewall rulesets.

Related Errors & Cross-Refs

Connection timed out, refused due to service down, and cloud security group conflicts.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

UFW documentation and Ubuntu server security hardening guides.