SSH Firewall
Review UFW rules and restrict SSH access to a known source.
Before you run
This Ubuntu UFW example does not enable or reset the firewall. Keep console access and the current session. Replace the documentation address and port with your actual client address and SSH port; account for IPv6, NAT, dynamic IPs and cloud security groups. Existing rule order and defaults affect access. Never remove an existing rule unless you know its purpose.
Server-side steps use Ubuntu as an example. Commands, configuration paths and service names may differ on other systems. Run client-side steps on the client as indicated.
After applying changes, verify that you can sign in and that the intended behavior works in a new SSH session. Keep the current session open until verification succeeds, so you can restore the configuration if necessary.
Examples
Inspect whether UFW is active and review numbered rules and defaults.
sudo ufw status verbose
sudo ufw status numberedIf your policy permits, add an allow rule for your actual trusted source and SSH port; replace the example address. This alone does not block other sources.
sudo ufw allow from 192.0.2.10 to any port 22 proto tcpTo undo only the example rule you added, use the same actual address and port. Verify access from a new session.
sudo ufw delete allow from 192.0.2.10 to any port 22 proto tcpAuthoritative references
Reviewed October 27, 2026