Question

How to change SSH port and firewall rule?

Posted January 5, 2018 9.8k views
Security DigitalOcean Articles

Hi, I have set up a different port for SSH(same way as it is described in the deprecated article) and custom firewall rule [TCP, all IP4/6] limited to the same port. I still can’t get connection[ssh: connect to host xx.xx.xx.xx port xxxx: Connection timed out]. What is the problem?

Add a comment
karolb
By:
karolb
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

2 answers
lampreyOne January 5, 2018

To change the port ssh works on, edit /etc/ssh/sshd_config and edit the line “Port 22” to be a different port.
Then restart sshd (“sudo service ssh restart”)
You can then test whether ssh is working on that port with “ssh localhost -p 1234” or whatever your new port is.

If that works, but remotely doesn’t work it’s probably the firewall issue.
How do you have your firewall set up?
The firewall from Digital Ocean’s control panel? UFW? IPTables?

Reply Report
  • karolb January 5, 2018

    I’ve used DO’s control panel.
    This is the output of $sudo ssh localhost -p xxxx typed in DO’s access console:

    The authenticity of host '[localhost]:xxxx ([127.0.0.1]:xxxx)' can't be established.
ECDSA key fingerprint is SHA256xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
Are you sure you want to continue connecting(yes/no)? yes
Warning: Permanently added '[localhost]:xxxx' (ECDSA) to the list of known hosts.
Permission denied (publickey).

    Should I add host with new port to the list of known hosts on my machine?

    Reply Report
    • karolb January 5, 2018 
      $ ssh localhost -p xxxx

      gives exacly same results plus it can’t create home/user/.ssh dir and add host to the list of known hosts

      Reply Report
    • lampreyOne January 5, 2018

      That just means that you haven’t set up your ssh key for your user on your droplet. It’s shown that you have connected to the ssh server on port xxxx.

      For the Firewall, you should set an Inbound rule. Type: Custom, Protocol:TCP, Port Range:XXXX, Sources: All ipV4

      Reply Report
lviterbo March 17, 2018

Helo LampreyOne,

Thanks a lot, for your tip.
I’ve been blocked to acces my droplet after the FIREWAL installation.
Then your solution was my salvation.

Sincerelly,

luciano viterbo

Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help