SSH Connection Refused After Enabling UFW

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote administration is lost immediately after firewall activation, risking operational lockout.

Environment & Reproduction

Ubuntu 20.04 servers where UFW default deny policy is enabled without explicit SSH allow.

Root Cause Analysis

Firewall policy denies inbound SSH traffic due to missing or misordered allow rules.

Quick Triage

Use console access to inspect UFW status and current ruleset before further network changes.

Step-by-Step Diagnosis

Validate listening SSH port, UFW profiles, and rule precedence for source restrictions.

Solution – Primary Fix

Insert explicit SSH allow rule, reload UFW, and confirm connectivity before ending console session.

Solution – Alternative Approaches

Use security groups/ACLs externally and keep host firewall minimal for managed environments.

Verification & Acceptance Criteria

SSH sessions establish reliably from approved sources while other inbound ports remain controlled.

Rollback Plan

Disable UFW temporarily from console if remote access cannot be recovered promptly.

Prevention & Hardening

Apply allow rules before enabling firewall and include out-of-band access for recovery.

Related Errors & Cross-Refs

`Connection refused`, `Operation timed out`, and unintended lockout during hardening rollout.

Related tutorial: View the step-by-step tutorial for Ubuntu 20.04 LTS.

View all Ubuntu 20.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

UFW best practices for Ubuntu server hardening and safe remote administration.