Linux Firewall Blocking SSH: Proven Fix Guide (2026)

Linux firewall blocking ssh is a common and frustrating issue that prevents remote access to your server or desktop. You try to connect via SSH, and you receive the dreaded “Connection refused” error.

When linux firewall blocking ssh occurs, the firewall is actively dropping or rejecting incoming SSH connection attempts. This comprehensive guide provides proven methods to diagnose and fix firewall restrictions on Ubuntu, Fedora, Arch, and other Linux distributions.

1. Root Cause

When linux firewall blocking ssh occurs, the system’s firewall is actively preventing incoming connections on port 22, the default SSH port. This is often a security feature that is enabled by default on many distributions to protect the system from unauthorized access.

Firewalls like firewalld, UFW (Uncomplicated Firewall), and iptables each have their own way of managing rules. Sometimes the SSH service is not explicitly allowed, resulting in dropped packets. Other times, the firewall is running but the SSH rule is missing or misconfigured.

Network configurations and multiple network interfaces can also cause issues. If your SSH server is listening on a non-standard port, the firewall may still block the default port while allowing the custom port.

Understanding these root causes helps you apply the right fix for linux firewall blocking ssh.

2. Verify Firewall Status

The first step to fix linux firewall blocking ssh is to determine which firewall is running on your system. Different distributions use different default firewall tools.

# Check firewalld (Fedora, RHEL, CentOS)
sudo systemctl status firewalld

# Check UFW (Ubuntu, Debian)
sudo ufw status

# Check iptables (general)
sudo iptables -L -n -v

If your firewall is not running, the issue may be elsewhere (like SSH service down). If it is running, note the active rules. With iptables, you may need to check all chains: sudo iptables -L INPUT -n -v.

Outcome: Identifying the firewall tool helps you apply the correct fix.

3. Open SSH Port with firewalld

For systems using firewalld (Fedora, RHEL, CentOS), opening the SSH port is straightforward. This is a reliable linux firewall blocking ssh fix.

# Add SSH service permanently
sudo firewall-cmd --add-service=ssh --permanent

# Reload firewalld
sudo firewall-cmd --reload

# Verify the rule
sudo firewall-cmd --list-services

According to the official firewalld documentation, adding the ssh service is the simplest way to allow SSH traffic. If you are using a non-standard port, use --add-port=2222/tcp instead.

Outcome: Adding SSH to firewalld resolves the issue for firewalld users.

4. Open SSH Port with UFW

For Ubuntu and Debian systems, UFW is the default firewall. Opening SSH is a common linux firewall blocking ssh fix.

# Allow SSH
sudo ufw allow ssh

# Or specify the port explicitly
sudo ufw allow 22/tcp

# Enable UFW if disabled
sudo ufw enable

# Check status
sudo ufw status verbose

According to the Ubuntu documentation, ufw allow ssh adds a rule to accept incoming SSH connections. If you need to change the SSH port, use sudo ufw allow 2222/tcp.

Outcome: Adding SSH to UFW resolves the issue for UFW users.

5. Open SSH Port with iptables

For systems using raw iptables, manually adding the SSH rule is required. This is a direct linux firewall blocking ssh fix.

# Allow incoming SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Save the rules (persistent)
sudo iptables-save > /etc/iptables/rules.v4

# For IPv6
sudo ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo ip6tables-save > /etc/iptables/rules.v6

According to the Arch Wiki, iptables rules are not persistent by default. You must save them after adding. The location of the save file may vary by distribution.

Outcome: Adding iptables rules resolves the issue for iptables users.

6. Temporarily Disable Firewall

If you need to test if the firewall is the culprit, temporarily disabling it can confirm linux firewall blocking ssh.

# firewalld
sudo systemctl stop firewalld

# UFW
sudo ufw disable

# iptables (flush all rules - careful!)
sudo iptables -F

Do not leave the firewall disabled permanently. This is only for testing. If SSH works after disabling, the firewall was the cause. Then re-enable it and add the SSH rule correctly.

Outcome: Disabling the firewall temporarily confirms the issue.

7. Make Firewall Rules Persistent

After adding SSH rules, ensure they survive reboots. This is a critical linux firewall blocking ssh fix for long-term use.

# firewalld (already persistent with --permanent)
sudo firewall-cmd --runtime-to-permanent

# UFW (saves automatically)
sudo ufw enable

# iptables (save manually)
sudo netfilter-persistent save
# or
sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6

For firewalld, using --permanent during the add operation saves it automatically. For UFW, enabling it saves the rules. For iptables, you must save manually or use a persistent script.

Outcome: Making rules persistent ensures the fix survives reboots.

8. Restart Firewall and SSH Services

Restarting services ensures changes take effect. This is a simple linux firewall blocking ssh fix after rule changes.

# Restart firewalld
sudo systemctl restart firewalld

# Restart UFW
sudo ufw reload

# Restart SSH server
sudo systemctl restart sshd

# Check SSH status
sudo systemctl status sshd

Restarting the SSH server ensures it is listening on the correct port and ready to accept connections. According to systemd documentation, restarting the service applies any configuration changes.

Outcome: Restarting services applies firewall and SSH changes.

9. Check SELinux/AppArmor for SSH

If the firewall is open but SSH still fails, SELinux or AppArmor may be blocking it. This is not a firewall issue but can contribute to linux firewall blocking ssh confusion.

# Check SELinux status
sudo getenforce

# Check AppArmor status
sudo aa-status | grep ssh

# Temporarily set SELinux to permissive for testing
sudo setenforce 0
# Re-enable after testing: sudo setenforce 1

If SELinux is enforcing, try setting it to permissive and testing SSH. If SSH works, you need to adjust SELinux policies. For AppArmor, check if SSH profiles are blocking access.

Outcome: Adjusting SELinux/AppArmor resolves the issue if they are blocking SSH.

10. Advanced: Check SSH Logs and Configuration

For advanced users, checking SSH logs and configuration provides a deep linux firewall blocking ssh diagnosis.

# View SSH logs
sudo journalctl -u sshd -n 50

# Check SSH config
sudo nano /etc/ssh/sshd_config

# Common issues: Port, PermitRootLogin, ListenAddress
# Example: Change port to 2222 and update firewall accordingly

If SSH is not listening, check that ListenAddress is set correctly and the port is not already in use. If you changed the port, update the firewall to allow the new port.

Outcome: Checking logs and config provides advanced diagnostics.

11. Frequently Asked Questions

Why does SSH say “Connection refused”?

This error typically means the firewall is blocking the connection, the SSH server is not running, or the server is listening on a different port.

How do I check if my firewall is blocking SSH?

Run sudo iptables -L -n to see if port 22 is allowed. On firewalld, use sudo firewall-cmd --list-services. On UFW, use sudo ufw status.

How do I open SSH port on firewalld?

Use sudo firewall-cmd --add-service=ssh --permanent and then sudo firewall-cmd --reload.

How do I open SSH port on UFW?

Use sudo ufw allow ssh or sudo ufw allow 22/tcp.

How do I open SSH port on iptables?

Run sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT and save with iptables-save.

Can SELinux block SSH connections?

Yes, SELinux can block SSH. Check with sudo getenforce and set to permissive for testing.

How do I make firewall rules persistent?

For firewalld, use --permanent. For UFW, they are persistent. For iptables, use iptables-save.

Why does SSH work after disabling the firewall?

This confirms the firewall was blocking SSH. Re-enable it and properly add the SSH rule.

What if SSH works locally but not remotely?

The firewall is likely blocking external connections. Ensure the rule applies to the external interface.

What should I do if none of these methods work?

Check /etc/ssh/sshd_config for ListenAddress and Port settings. Also check system logs with journalctl -xe.

12. Conclusion

The linux firewall blocking ssh issue is common but solvable. By verifying firewall status, adding SSH rules, and making them persistent, you can restore remote access. For more information, visit the firewalld official site, the Ubuntu UFW documentation, or the Arch Linux iptables wiki. With this proven guide, you can overcome the linux firewall blocking ssh challenge and maintain secure remote access.

For more Linux troubleshooting, explore our Linux Hub and guides on Ubuntu broken packages fix, Ubuntu failed to fetch apt update fix, and Linux no sound after update. With the right approach, you can resolve the linux firewall blocking ssh issue and keep your system accessible.