I'm trying to set up a debian server in the cloud, over SSH. I log in using a key.

After the initial startup I want to set UFW:

apt-get install ufw
ufw allow ssh
ufw enable

This is how I've done this in the past when logged in via SSH. However with this server the connection is lost and it seems I'm locked out. I've tried this twice. Maybe I'm overlooking something, but I thought this was the way to do this. What is happening here? Why doesn't this work?

NB: I've realized that I can disable ufw via a cronjob every 15 minutes. This makes testing possible and makes the machine accessible a short while after a failed attempt.


Below is the content of /lib/ufw/user.rules. The file user6.rules has similar content.

:ufw-user-input - [0:0]
:ufw-user-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-logging-deny - [0:0]
:ufw-logging-allow - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
### RULES ###

### tuple ### allow tcp 22 any in
-A ufw-user-input -p tcp --dport 22 -j ACCEPT

### END RULES ###

### LOGGING ###
-A ufw-after-logging-input -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
-A ufw-after-logging-forward -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
-I ufw-logging-deny -m state --state INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
-A ufw-logging-deny -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
-A ufw-logging-allow -j LOG --log-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10

-A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT
-A ufw-user-limit-accept -j ACCEPT

The following command results in an error, because there are no rules yet. This is right after installing UFW.

ufw insert 1 allow 22/tcp
ERROR: Invalid position '1'
  • Can you alter your cron job to be ufw status > ~/ufwstatus && ufw disable ?
    – Jesse K
    Apr 1 '16 at 20:53

After executing the command, running this command will allow you to confirm if the rule is actually in place, and nothing else is blocking it (this requires you to be connected and for the firewall to be running - go in via the console to ensure ssh doesn't kick you out while testing):

ufw status

To remedy your issue, I'd recommend trying the following command:

ufw insert 1 allow 22/tcp

This will add a rule for ssh connections from anywhere to be allowed at the top of your firewall table rule-set – or alternatively and better from a security perspective, IP based restriction can be included:

ufw insert 1 allow from <YOUR IP> proto tcp to any port 22

This will add a rule to allow connections over ssh only from your IP.

Reason for putting the rule at top is to circumvent any deny rules that might be causing you trouble. Also worth ensuring ssh is installed and running:

apt-get install openssh-server
service ssh start
  • Thanks for your answer. See my updated answer. Your suggestion returns an error. There are no rules right after installing UFW, and apparently you can't use a number when there are no other rules. Inserting the rule by ufw allow 22 makes it rule 1 anyway, just like I thought. This cloud provider does not offer a console option like Linode has, so once you're locked out, that's it AFAIK and you can start over.
    – SPRBRN
    Nov 19 '15 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.