The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →On a remote Ubuntu server, add the SSH allow rule before enabling UFW. For the usual SSH service on TCP port 22, run sudo ufw allow ssh, verify the pending configuration, enable the firewall, and verify again. If SSH listens on another port, allow that port instead; when possible, restrict the rule to your trusted IP address or network.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What allowing SSH through UFW actually does
UFW is Ubuntu’s standard firewall configuration tool. An SSH rule tells UFW which inbound TCP connection should be accepted so that an SSH client can reach the server. The rule does not start the SSH daemon, change its configuration, create a user, or authenticate anyone; it only controls whether matching traffic is permitted through the firewall.
As an Amazon Associate I earn from qualifying purchases.
The familiar SSH service normally listens on TCP port 22. That is a convention, not a guarantee. An administrator may configure the daemon to listen on a different port, and the firewall rule must match the actual listener. UFW can identify the service by the service name ssh when that name is defined in /etc/services, or you can state the port and protocol explicitly.
The safe remote procedure
If you are connected over SSH, the order of operations matters. Add and inspect the rule first, then enable UFW. Enabling the firewall before permitting your management connection can terminate your access or leave future connections blocked.
#1 Best Overall
-
Permit the SSH service:
sudo ufw allow ssh -
Inspect the resulting configuration before changing the firewall state:
sudo ufw status verbose -
Enable UFW:
sudo ufw enable -
Confirm the active configuration again:
sudo ufw status verbose
Keep your current SSH session open until the final status check succeeds. Opening a second session from the same administration network is a practical way to verify that a new connection can still be established before you close the original one.
Recommended Free Tools
Choose the rule syntax that fits your situation
These forms express the same basic intent but differ in clarity and portability. The service-name form is concise; the explicit form makes the protocol and port visible to anyone reviewing the rule.
| Use case | Command | What it permits |
|---|---|---|
| SSH service name | sudo ufw allow ssh |
Traffic identified as the SSH service through the system service definition. |
| Default SSH port, explicit TCP | sudo ufw allow 22/tcp |
TCP connections to port 22 from any source. |
| Default port number | sudo ufw allow 22 |
Port 22 using UFW’s port rule syntax; specify the protocol explicitly when you want the rule to be unambiguous. |
| Custom SSH port | sudo ufw allow 2222/tcp |
TCP connections to port 2222; substitute the port configured for your SSH daemon. |
The service-name rule depends on the local /etc/services entry. An explicit port rule is easier to audit when the daemon uses a nonstandard port or when you are documenting infrastructure for another administrator.
Allow SSH on a custom port
Do not assume that port 22 is correct merely because it is the default. Use the port configured for the SSH daemon and include the protocol. For a daemon listening on TCP port 2222, the rule is:
sudo ufw allow 2222/tcpReplace 2222 with the real listener port. If you permit port 22 while the daemon listens elsewhere, UFW will not make SSH reachable; if another service uses port 22, you may expose that service instead of SSH.
UFW’s general port syntax is PORT[/PROTOCOL]. The protocol suffix is useful because SSH uses TCP, and stating it prevents the rule from being interpreted more broadly than intended. After adding the rule, check the output of sudo ufw status verbose and confirm that the displayed port corresponds to the daemon’s configuration.
Restrict SSH to a trusted IP address or subnet
An unrestricted allow rule accepts matching SSH traffic from every source that can reach the server. If administration comes from a stable office, VPN, bastion host, or other known network, a source restriction reduces the number of systems that can even attempt an SSH connection.
Permit one trusted host
sudo ufw allow proto tcp from 192.0.2.10 to any port 22This example permits TCP port 22 only when the source address is 192.0.2.10. Replace that documentation address with the public address from which your administration traffic actually originates. If your SSH daemon uses a custom port, replace 22 with that port.
Permit a trusted subnet
sudo ufw allow proto tcp from 192.0.2.0/24 to any port 22The CIDR suffix /24 represents the stated subnet. Use the network and prefix length assigned to your trusted administration network, not a guessed range. A subnet rule is appropriate when legitimate administrators use several addresses in the same controlled network; it is broader than a single-host rule.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCheck the practical consequence before restricting
-
Identify the source address that the server will see. A private workstation address may be translated by a router, VPN, or cloud gateway before it reaches the server.
-
Ensure every legitimate administration path is covered. A rule limited to an office address can block you when you later connect through a VPN or another approved location.
-
Add the restricted rule before removing a broader rule, and test a new SSH session while the current session remains open.
Use rate limiting when a broad allow rule is unavoidable
When you cannot restrict SSH to a known source network, UFW also supports a rate-limited form. The ufw manual documents:
sudo ufw limit 22/tcpA limit rule is different from a normal allow rule: it is intended to reduce repeated connection attempts to the specified TCP port. It is not a replacement for source restriction when you have a reliable list of trusted addresses, and it does not replace strong SSH authentication or sensible daemon configuration. Apply it to the actual SSH port if the daemon is not using 22.
Preview a rule without applying it
For a change you want to inspect first, use UFW’s dry-run option:
sudo ufw --dry-run allow 22/tcp--dry-run prints the rules that would result without applying the change. This is useful when you are working on a production host, reviewing a custom-port expression, or checking how a source restriction will be represented. A dry run is only a preview; you still need to run the command without --dry-run to create the rule.
Verify that the rule is active and understandable
UFW provides several status views. Use the least detailed view for a quick check, the verbose view for policy and logging information, and the numbered view before editing rules.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Command | When to use it |
|---|---|
sudo ufw status |
Quickly see whether UFW is active and which rules are listed. |
sudo ufw status verbose |
Confirm the active state and inspect the fuller rule and policy display after a change. |
sudo ufw status numbered |
Show rule numbers before deleting or otherwise modifying a particular entry. |
Look for the intended SSH port, the TCP protocol, and the source scope you selected. A rule that says port 22 is open to all sources is materially different from one that names a single host or subnet. If you added both a broad and a restricted rule, the broad rule can make the restriction ineffective for traffic it already matches.
Understand rule order before adding exceptions
UFW evaluates matching rules in order. Overlapping entries therefore deserve attention: a generic allow rule can match traffic before a later, more specific rule is considered. For example, adding sudo ufw allow 22/tcp and then adding a rule limited to one source does not turn the first rule into a restricted rule; the generic entry still permits other sources.
Run:
sudo ufw status numberedReview the numbered list, identify duplicate or overlapping SSH entries, and decide which policy you actually want. Keep one intentional rule where possible. If you need to remove an entry by its position, use the numbered deletion form supported by UFW, and recheck the list afterward so that you do not accidentally remove the wrong rule after numbering changes.
Delete or replace an SSH rule
To remove a rule, repeat the original expression after the word delete. For an explicit default-port rule:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorssudo ufw delete allow 22/tcpFor a service-name rule, use the matching expression:
sudo ufw delete allow sshFor a source-restricted rule, repeat the complete source, protocol, destination, and port expression. The more precisely your deletion command matches the rule you created, the less likely you are to remove a different entry. When several similar entries exist, inspect status numbered first and use the rule number if that is clearer.
Rank #4
Do not delete the only working SSH rule from a remote host until a replacement rule is already present and a second connection has been tested. If you need to change from an unrestricted rule to a restricted one, add and test the restricted rule first, then remove the broad rule.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and recovery paths
UFW was enabled before SSH was allowed
If a remote session stops accepting new connections after enabling UFW, use an out-of-band route such as the server console or your hosting provider’s recovery console. From that local administrative channel, add the appropriate SSH rule, inspect the status, and test a fresh connection. Do not rely on an existing session as proof that new traffic is permitted.
Free tools Windows power users keep installed
One-click scans. No signup required.
The rule uses port 22 but SSH is configured elsewhere
Replace the service-name or port-22 rule with the daemon’s configured TCP port. A firewall rule for the wrong port cannot make the service reachable. Confirm the displayed UFW entry after making the change.
The source restriction uses the wrong address
Traffic may arrive from a VPN gateway, office router, bastion host, or other translated address rather than the address shown on the workstation. Correct the rule to the source address visible to the server, and keep an alternate approved access path available while testing.
A broad rule defeats a specific rule
Use sudo ufw status numbered to find overlapping entries. Remove the generic allow rule if the intended policy is source-restricted, then verify that the remaining rule names the expected source and port.
The command appears to work but the connection still fails
-
Check that UFW is active and that the expected rule is present with
sudo ufw status verbose.Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Check that the rule’s port matches the SSH daemon’s configured listener.
-
Check that the source address or CIDR includes the network from which you are connecting.
-
Check for an earlier overlapping rule and review the numbered order.
-
Remember that UFW only controls the firewall path; it does not start the daemon or change SSH authentication settings.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
A practical decision guide
| Situation | Prefer | Reason |
|---|---|---|
| You are using the conventional SSH service and want a short command | sudo ufw allow ssh |
Uses the service name defined by the system service database. |
| You want the port and protocol obvious in configuration reviews | sudo ufw allow 22/tcp |
States TCP port 22 explicitly. |
| The daemon listens on a nonstandard port | sudo ufw allow <port>/tcp |
Matches the actual listener instead of assuming port 22. |
| Only one fixed administration host should connect | sudo ufw allow proto tcp from <ip> to any port <port> |
Reduces the permitted source set to one address. |
| Several approved addresses share a controlled network | sudo ufw allow proto tcp from <cidr> to any port <port> |
Allows the required subnet while excluding other sources. |
| You need to reduce repeated attempts but cannot maintain a source list | sudo ufw limit <port>/tcp |
Applies UFW’s documented connection-rate control form. |
| You want to inspect a change first | sudo ufw --dry-run allow <port>/tcp |
Shows the resulting rules without applying them. |
The angle-bracketed values in the table are descriptive placeholders for the real port, IP address, or CIDR in your environment; when entering a command, replace them with actual values and omit the brackets.
Final checklist for a remote Ubuntu server
-
Determine whether SSH uses TCP port 22 or a configured custom port.
-
Choose a service-name, explicit-port, source-restricted, or rate-limited rule that matches your access model.
-
Add the allow rule before enabling UFW.
-
Run
sudo ufw status verbosebefore and aftersudo ufw enable.Recommended: Crashes or Glitches? A Free Driver Scan Usually Finds the Culprit →Recommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →Recommended: Update Every Outdated Driver on Your PC in One Scan - Free →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Use
sudo ufw status numberedbefore deleting or changing overlapping entries. -
Keep the current session open and test a new SSH connection after every remote firewall change.
Quick Recap
Bestseller No. 1SaleBestseller No. 3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
