Recovering SSH After ufw Firewall Misconfiguration

One wrong ufw command can lock you out of your server instantly. I experienced this while configuring a new Ubuntu server - a single ufw deny ssh command terminated my session. This guide covers immediate recovery and safe configuration practices.

Environment

• OS: Ubuntu 22.04 LTS
• Firewall: ufw (Uncomplicated Firewall)
• SSH port: 22 (default)

$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)

To                         Action      From
--                         ------      ----
22/tcp                     DENY IN     Anywhere

The Problem

# The command that caused the problem
$ sudo ufw deny ssh
Rule added
Rule added (v6)

# SSH session immediately dropped
Connection to server.example.com closed by remote host.

Analysis

Access via Console

Use your cloud provider's web console or physical console access:

# After logging in via console
$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     DENY IN     Anywhere
22/tcp (v6)               DENY IN     Anywhere (v6)

Solution

Fix 1: Allow SSH and Reload

# Allow SSH
$ sudo ufw allow ssh
Rule added
Rule added (v6)

# Or specifically
$ sudo ufw allow 22/tcp

# Reload ufw
$ sudo ufw reload

# Verify
$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
22/tcp (v6)               ALLOW IN    Anywhere (v6)

Fix 2: Reset ufw to Defaults

# Reset all rules
$ sudo ufw reset
Resetting all rules to installed defaults. This may involve removing
some user defined rules, this is a destructive operation!
Proceed with operation (y|n)? y

# Start fresh
$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing
$ sudo ufw allow ssh
$ sudo ufw enable

Fix 3: Insert Allow Rule Before Deny

# Insert rule at position 1 (before any deny rules)
$ sudo ufw insert 1 allow ssh

# Verify rule order
$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 22/tcp                     DENY IN     Anywhere

Fix 4: Use ufw Allow from Specific IP

# Allow SSH only from your IP
$ sudo ufw allow from 192.168.1.100 to any port 22

# Allow from subnet
$ sudo ufw allow from 192.168.1.0/24 to any port 22

# Verify
$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    192.168.1.100
22/tcp (v6)               ALLOW IN    Anywhere (v6)

Safe ufw Configuration

Create a Safe Setup Script

#!/bin/bash
# /usr/local/bin/safe-ufw-setup.sh

# Reset to defaults
sudo ufw --force reset

# Set defaults
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed

# Allow SSH (FIRST - before enabling)
sudo ufw allow ssh

# Allow HTTP/HTTPS
sudo ufw allow http
sudo ufw allow https

# Enable firewall
sudo ufw enable

# Show status
sudo ufw status verbose

Use numbered mode for rule management

# List rules with numbers
$ sudo ufw status numbered

# Delete specific rule
$ sudo ufw delete 2

# Insert rule at position
$ sudo ufw insert 1 allow 80/tcp

Common ufw Mistakes and Fixes

Quick Recovery Commands

# Emergency: disable ufw
$ sudo ufw disable

# Check status
$ sudo ufw status

# List all rules
$ sudo ufw status verbose

# Delete a rule
$ sudo ufw delete [rule]

# View log
$ sudo journalctl | grep ufw

Prevention

1. Always test firewall changes in a separate terminal before closing the current one.
2. Use ufw allow ssh before enabling ufw.
3. Keep console access available when making firewall changes.
4. Use ufw status numbered to see rule order.
5. Document all firewall rules for team reference.

This blog does not accept any external sponsorships, affiliate marketing, or ad revenue.