Locked out by your firewall? How to get back into your VPS

A single firewall rule in the wrong place can cut off SSH, and every new connection then times out. Your server is still running and your data is safe. This guide shows you how to get in through the browser console, switch off the blocking firewall, fix the rule and turn protection back on without locking yourself out again.

Before you start

• Access to your VPS provider's control panel with the server listed under your services.
• The server's root or sudo username and password. They are on the service page in your VPS provider's control panel. If you only ever log in with an SSH key and never set a password, see the troubleshooting section.
• A few minutes. Nothing here needs a reboot or a reinstall.

Confirm it really is the firewall

From your computer, test the SSH port:

nc -vz -w 5 203.0.113.10 22

On Windows PowerShell:

Test-NetConnection 203.0.113.10 -Port 22

• Timeout or TcpTestSucceeded: False: something drops the traffic. A firewall rule is the usual cause, especially if you just changed one.
• Connection refused: the port is reachable but nothing listens. That points to the SSH service, not the firewall. See Fix SSH connection refused or timed out.
• Connects, but login fails: this is a key or password problem, not a firewall problem.

Log in through the browser console

1. Sign in to your VPS provider's control panel and open the service.
2. Open the control panel and start the browser console. It connects to the server's screen directly, so firewall rules do not affect it.
3. Press Enter if the screen is blank, then log in with the username and password from the service page.

Turn off the firewall that blocks you

Find out which firewall is active. Run the commands for your setup:

sudo ufw status
sudo systemctl is-active firewalld
sudo nft list ruleset | head -20

UFW (Ubuntu and Debian)

sudo ufw disable

firewalld (AlmaLinux and Rocky Linux)

sudo systemctl stop firewalld

Use stop, not disable, so it still starts at the next boot once you have fixed it.

nftables or iptables

Clear the ruleset in memory:

sudo nft flush ruleset

For plain iptables, open the policy and flush:

sudo iptables -P INPUT ACCEPT
sudo iptables -F INPUT

Now test SSH from your computer again. It should connect. Leave the console open as a backup while you work.

Fix the rule

Find which SSH port the server uses:

sudo ss -tlnp | grep sshd

The number after the colon, for example 0.0.0.0:22, is the port your allow rule must match. Then add the allow rule for your firewall.

UFW

sudo ufw allow 22/tcp
sudo ufw show added

If you use a custom port, replace 22. Remove any deny rule that matches your port or your own IP with sudo ufw status numbered and sudo ufw delete <number>.

firewalld

sudo systemctl start firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-port=2222/tcp   # only if SSH uses 2222
sudo firewall-cmd --reload

Starting firewalld here is safe only because you are on the console. Confirm SSH from your computer right after the reload.

nftables

Edit /etc/nftables.conf and make sure the input chain contains a line such as tcp dport 22 accept above any drop rule. Then check and load it:

sudo nft -c -f /etc/nftables.conf
sudo nft -f /etc/nftables.conf

The -c flag checks the file without applying it.

Re-enable the firewall safely

1. Keep the browser console open.
2. Turn the firewall back on:

   sudo ufw enable

For firewalld, sudo systemctl start firewalld. For nftables, sudo systemctl restart nftables.

1. From your computer, open a new SSH session. Do not close the console until it works.

For future changes, schedule an automatic undo before you touch rules. See Test firewall changes safely with an automatic rollback.

Check it works

• A fresh SSH login from your computer succeeds.
• The firewall shows as active with your SSH rule:

  sudo ufw status verbose
  sudo firewall-cmd --list-all

• After the next planned reboot, SSH still works. That proves the saved rules are correct, not just the live ones.

Troubleshooting

• Console login fails with your VPS provider's control panel password: you may have changed the root password since. If you never set one and use keys only, you can reset access by reinstalling, which erases data, so open a ticket first and ask what options exist for your service.
• SSH still times out with the firewall off: the block is elsewhere. Check sudo ss -tlnp shows sshd listening, and check Fail2ban has not banned your IP: sudo fail2ban-client status sshd.
• You changed the SSH port and forgot it: read it from the config with sudo sshd -T | grep -i '^port'.
• Rules come back broken after reboot: the saved files still hold the bad rule. Fix the persistent config, not only the live rules.
• Stuck at any step: open a ticket and say which firewall you use and what you changed.

Next steps

• Learn safe rule order with UFW: Open ports with UFW.
• Understand the console better: When to use the browser console.
• Harden SSH once you are back in: SSH hardening checklist.