Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →If an iptables change blocks SSH, stop trying to repair it through the blocked connection. Open your VPS provider’s out-of-band console or rescue environment, inspect both IPv4 and IPv6 rules, add the narrowest temporary access rules, test a fresh SSH session, and only then save the rules for reboot. A normal reboot does not reliably fix the problem: it may clear only in-memory rules, or a persistence service may immediately restore the same broken rules.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What to do first
Your recovery entry point is a management path that does not depend on the guest’s firewall. Depending on the provider, that may be called a Recovery Console, Lish, VNC or serial console, or Rescue System. Use it instead of repeatedly reconnecting over SSH. Repeated attempts cannot bypass a packet filter, and making more remote changes while you cannot see the result can turn a single rule mistake into a second one.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Leave the failed SSH window open so you can see whether access returns, but do not use it to issue more commands.
- Open the provider’s independent console. If no console is available, activate the provider’s rescue or live system.
- Keep the console connected for the entire repair. Do not close it when you think the firewall is fixed.
- Use a second terminal to make a completely new SSH connection. The existing session is not proof that new connections work.
DigitalOcean states that its Recovery Console “provides out-of-band access and is available regardless of your network settings.” Its Recovery ISO supplies an interactive shell and can be used for filesystem checks and a chroot when the installed system will not boot normally. Linode directs users locked out by firewall rules to the Lish Console in Cloud Manager. Hetzner’s Rescue System is a live Linux environment intended to correct a mistaken network configuration or overly restrictive firewall rules.
Why rebooting is not a recovery plan
iptables rules live in the running kernel. A reboot can remove them if nothing restores a saved ruleset during startup, but that behavior depends on the distribution and its firewall tooling. Systems using iptables-persistent, netfilter-persistent, a legacy iptables service, firewalld, UFW, or custom startup scripts may reload the same bad policy before networking is usable.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A reboot also has costs: it ends running game servers, may require a rescue-system boot cycle, and can remove evidence you need for diagnosis. If the machine is reachable only through a provider console, a reboot can leave you waiting for the console or for an incorrectly configured boot process. Treat rebooting as a deliberate recovery action, not as a way to “reset” the firewall.
Provider recovery paths
Provider interfaces change over time, so look for the current console or rescue control in the server-management page rather than relying on an old menu name. The operational differences that matter are summarized here.
| Provider option | Independent of guest networking? | Live or rescue environment | Recovery credentials | IPv4 and IPv6 controls | Reboot needed? |
|---|---|---|---|---|---|
| DigitalOcean Recovery Console | Yes; DigitalOcean describes it as out-of-band and available regardless of network settings. | Recovery ISO provides a shell, fsck, and chroot. |
Use the root or administrative credentials and keys configured for the droplet; the provider documentation determines what the selected recovery mode accepts. | Not stated as a single provider-console control; inspect both rulesets inside the guest. | Console access does not depend on a network reboot; booting the Recovery ISO does. |
| Linode Lish Console | Yes; Linode’s iptables guide points locked-out users to Lish. | Lish gives a login path to the installed system; a separate live rescue workflow is not stated in the cited guidance. | Log in as root or a sudo-capable user, as Linode’s guidance specifies. | Not stated in the cited guidance; inspect iptables and ip6tables separately. |
Not stated for Lish repair; choose a reboot only when the selected recovery workflow requires it. |
| Hetzner Rescue System | Yes; it is a provider-activated live environment rather than the blocked guest network. | Live Linux system for finding and correcting network or restrictive-firewall errors. | Use the rescue credentials or SSH keys supplied by the provider interface. | Not stated as a single rescue control; correct IPv4 and IPv6 configuration independently. | Hetzner’s workflow is activated through the provider interface before rebooting into rescue. |
The exact recovery decision is simple: use a console that reaches the running installation when possible; use a rescue system when the installation cannot boot, its filesystem is damaged, or you need to mount and edit it offline. A network-dependent web console that ultimately reaches the server through SSH is not an out-of-band path and will fail for the same reason as your terminal.
Capture the current firewall state before editing
Run these commands from the installed system’s console while it is booted normally:
iptables-save > /root/iptables-broken.v4
ip6tables-save > /root/ip6tables-broken.v6
iptables -L -n -v --line-numbers
iptables -S
ip6tables -L -n -v --line-numbers
ip6tables -SThe two save files are a rollback record. If the console environment cannot write to the installed root filesystem, copy the output into a text file in the rescue environment instead. In a live rescue system, first mount the server’s root volume and identify whether you are inspecting the rescue system’s own empty ruleset or the installed system’s rules. If the provider documentation supports it, use chroot after mounting the installed root so commands and paths refer to the actual server.
Read both the policy and the individual rules. The common lockout patterns are:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Default INPUT policy is DROP. A missing allow rule then blocks every new inbound connection.
- An early DROP or REJECT appears above the SSH allow rule. Rules are evaluated in order, so a later allow rule never runs.
- The interface match is wrong. A rule for
eth0will not match a host whose active interface has another name. - The source address is wrong. A changing home address, VPN address, or office gateway may no longer match the permitted source.
- The port is wrong. The daemon may listen on a non-default port while the firewall allows only TCP 22, or the firewall may allow a port on the wrong protocol.
- IPv6 was overlooked. A successful IPv4 rule does nothing for an SSH client connecting to an IPv6 address, and an IPv6 DROP does not get fixed by changing IPv4 rules.
- OUTPUT is blocked. DNS, package downloads, monitoring, and replies can fail even after INPUT is corrected if outbound traffic is filtered.
Use packet and byte counters in the verbose listing as clues, not as proof. A counter that remains at zero may mean the rule is wrong, the client is using another address family, or traffic is being stopped earlier in the chain.
Restore SSH access without opening more than necessary
First determine the actual SSH port and the administrator’s current source address. On the server, check the SSH daemon configuration and listening sockets with the tools available on that distribution. From the client, note whether the connection is using an IPv4 or IPv6 destination. If you cannot confidently identify the source address, use a temporary, controlled allow rule only while the console remains open; replace it with a restricted source rule before persisting anything.
Insert rules ahead of a blocking policy
If the existing rules are too restrictive but otherwise usable, insert emergency rules near the top of the relevant chain. Replace SSH_PORT and ADMIN_IP with your values:
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -I INPUT 2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -I INPUT 3 -p tcp --dport SSH_PORT -s ADMIN_IP -m conntrack --ctstate NEW -j ACCEPTThe loopback rule preserves local service communication. The established/related rule allows replies for connections that are already tracked. The final rule permits only new TCP connections to the SSH port from the specified administrator address. Inserting rules matters: appending an allow rule after an unconditional DROP or REJECT will not help.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIf the server’s administrative path uses IPv6, make the equivalent change with ip6tables and an IPv6 source address:
ip6tables -I INPUT 1 -i lo -j ACCEPT
ip6tables -I INPUT 2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
ip6tables -I INPUT 3 -p tcp --dport SSH_PORT -s ADMIN_IPV6 -m conntrack --ctstate NEW -j ACCEPTDo not copy an IPv4 address into an IPv6 rule or assume that a hostname’s first address is the one your client will use. Test each family deliberately if the host advertises both.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When OUTPUT is part of the outage
If the bad change modified OUTPUT, add only the outbound permissions needed to administer and verify the server, and put them ahead of the blocking rule. The exact requirements depend on your environment; DNS, repository access, time synchronization, monitoring, and game-server dependencies may use different destinations and ports. Avoid replacing a restrictive policy with an undocumented “allow everything” rule. Once SSH works, document and narrow every temporary exception.
Do not flush blindly
Flushing a table can restore access quickly, but it also removes protections and may disrupt a running game service. If you must use an emergency flush from the provider console, keep the console open, install a known-good complete ruleset immediately, and test it before exposing the host to the public network. Preserve the files you captured first so the original policy can be reconstructed.
Validate a ruleset before committing it
If you have a known-good file, test its syntax and structure before replacing the active policy. Debian documents this form:
iptables-restore --test < rules.v4The --test option parses and constructs the ruleset without committing it. Use the IPv6 restore command’s test option where that implementation supports it:
ip6tables-restore --test < rules.v6Be aware that a normal restore flushes existing table contents unless --noflush is used. A file intended as a complete replacement should therefore contain every required table and rule, including loopback, established traffic, management access, and the intended default policies. A fragment intended to supplement existing rules needs a deliberate --noflush strategy and should not be treated as a complete backup.
After a successful syntax test, apply the rules from the console and immediately inspect them:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
iptables-restore < rules.v4
ip6tables-restore < rules.v6
iptables -L -n -v --line-numbers
ip6tables -L -n -v --line-numbersIf the IPv6 file is absent because IPv6 is disabled, confirm that fact rather than silently assuming the address family is safe. If IPv6 is enabled, maintain an intentional IPv6 policy; leaving it unfiltered while hardening IPv4 is a separate exposure, not a fix.
Prove that a new SSH login works
Keep the provider console attached and open a second local terminal. Start a new connection rather than relying on an existing multiplexed session. Verify all of the following:
- The hostname or address resolves to the expected server.
- The client is trying the intended IPv4 or IPv6 address.
- The destination port matches the daemon’s listening port.
- The source address matches the firewall’s allow rule.
- The expected key or password authentication succeeds.
- A second independent session can execute a harmless command.
If IPv4 succeeds but IPv6 fails, inspect only the IPv6 path: the client’s selected address, the server’s IPv6 route, ip6tables policy, and any provider-level IPv6 firewall. If IPv6 succeeds but IPv4 fails, perform the corresponding IPv4 checks. Do not “fix” a family that is already working by deleting its rules.
Leave the console in place until the new login has remained usable long enough to perform the next administrative step. This prevents a second lockout caused by a delayed rule reload, a service restart, or a typo in the persistent file.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Persist the corrected policy only after testing
Saving rules is distribution-specific. Identify the active firewall manager before writing a file. A host managed by firewalld or UFW may regenerate iptables-compatible rules, while a legacy iptables service or iptables-persistent may read a particular file at boot. Saving to a file that no startup service reads gives a false sense of safety; saving through the wrong manager can cause two systems to overwrite each other.
Ubuntu-style file restore
Ubuntu documentation describes saving the active rules with:
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
iptables-save > /etc/iptables.rulesIts corresponding restore command is:
iptables-restore < /etc/iptables.rulesUse the distribution’s documented IPv6 file and startup integration as well when IPv6 is enabled. Confirm which service restores the files during boot, then perform a controlled reload or reboot only after a rollback copy exists.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Red Hat legacy iptables service
Red Hat documents:
service iptables saveThis writes /etc/sysconfig/iptables; the service uses iptables-restore to reload it at boot. The command applies to systems using that legacy service, not automatically to every current Red Hat-derived installation. Check whether firewalld or another manager owns the policy before using it.
Make rollback part of the change
Before future restrictive changes, create a timestamped copy of the working IPv4 and IPv6 rules and arrange a rollback that does not depend on the new SSH path. A provider console, a local scheduled task, or a timed script that restores the previous policy can provide that safety window. Prefer an atomic, tested restore over a long sequence that changes the default policy first and adds exceptions later.
A practical change sequence is:
- Save the known-good IPv4 and IPv6 rules.
- Prepare the complete replacement files offline.
- Run both restore test commands.
- Schedule or prepare a rollback before applying the change.
- Apply the rules from the console or a still-working session.
- Open a new SSH session over IPv4 and, when enabled, another over IPv6.
- Persist the policy through the firewall manager that actually owns startup.
- Reboot only as a controlled verification, with the console available and the rollback ready.
Rescue-system recovery when the installed OS is inaccessible
A live rescue system changes where you run the commands. The rescue kernel’s active firewall is not necessarily the installed server’s firewall, so editing the rescue environment alone will not repair the next normal boot.
- Activate rescue mode in the provider control panel and boot it according to that provider’s instructions.
- Identify the installed system’s root volume and mount it read-write only when necessary.
- Copy the installed system’s persistent firewall files to a separate backup location.
- Use
chrootwhen you need the installed system’s command paths, packages, or service configuration. - Edit or replace the persistent IPv4 and IPv6 rules with a tested known-good version.
- Check the SSH daemon configuration and firewall-manager enablement while chrooted.
- Unmount cleanly, disable rescue mode, and boot the installed system.
- Keep the provider console available and test new IPv4 and IPv6 SSH sessions before declaring recovery complete.
DigitalOcean specifically describes its Recovery ISO as providing an interactive shell, fsck, and chroot. Hetzner describes its Rescue System as a way to find and correct configuration mistakes and regain access immediately. Linode’s Lish path is intended to let you log in and repair rules on the installed server without depending on ordinary SSH.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteCommon failed fixes and what they mean
| Symptom | Likely cause | Next check |
|---|---|---|
| Appending an SSH allow rule changes nothing. | An earlier DROP or REJECT, or a DROP chain policy, is evaluated first. | Inspect numbered rules and insert the allow rule before the blocker. |
| The current SSH window works but a new one fails. | The existing connection is tracked while NEW traffic remains blocked. | Test a second session and verify the NEW-state SSH rule. |
| IPv4 works and IPv6 times out. | The two address families have separate rules or routes. | Inspect ip6tables, the IPv6 route, and the client’s selected address. |
| Rules look correct until reboot. | A startup manager restored an older file or a different firewall manager owns the policy. | Identify the active persistence service and compare its file with the tested rules. |
| The rescue boot appears fixed, but normal boot is still locked out. | Commands changed the rescue environment rather than the installed filesystem. | Mount the installed root, back up its files, and edit it directly or through chroot. |
| SSH connects but administration fails afterward. | OUTPUT filtering blocks DNS, package repositories, monitoring, or other required services. | Inspect OUTPUT counters and add only the required outbound permissions. |
How to prevent the next lockout
- Keep a provider console or rescue path tested before you need it.
- Maintain separate, versioned IPv4 and IPv6 rules files.
- Use source-restricted SSH rules and document the addresses or networks they depend on.
- Insert loopback and established/related rules before applying a default DROP policy.
- Use
iptables-restore --testand the IPv6 equivalent where supported before every file-based restore. - Make one firewall change at a time and test a fresh SSH connection after each change.
- Keep a second terminal and the provider console open until persistence has been verified.
- Schedule a timed rollback for changes that could affect INPUT, OUTPUT, routing, or the SSH port.
- Record which tool owns the firewall so a later service restart does not silently replace your policy.
The resilient design is not a particular provider or a permissive firewall. It is an independent recovery path, a captured and testable ruleset, explicit handling for both address families, and a rollback that remains available while you change the policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
