How to change SSH port and firewall rule?

Posted January 5, 2018 17.8k views
SecurityDigitalOcean Articles

Hi, I have set up a different port for SSH(same way as it is described in the deprecated article) and custom firewall rule [TCP, all IP4/6] limited to the same port. I still can’t get connection[ssh: connect to host xx.xx.xx.xx port xxxx: Connection timed out]. What is the problem?

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
2 answers

To change the port ssh works on, edit /etc/ssh/sshd_config and edit the line “Port 22” to be a different port.
Then restart sshd (“sudo service ssh restart”)
You can then test whether ssh is working on that port with “ssh localhost -p 1234” or whatever your new port is.

If that works, but remotely doesn’t work it’s probably the firewall issue.
How do you have your firewall set up?
The firewall from Digital Ocean’s control panel? UFW? IPTables?

  • I’ve used DO’s control panel.
    This is the output of $sudo ssh localhost -p xxxx typed in DO’s access console:

    The authenticity of host '[localhost]:xxxx ([]:xxxx)' can't be established.
    ECDSA key fingerprint is SHA256xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
    Are you sure you want to continue connecting(yes/no)? yes
    Warning: Permanently added '[localhost]:xxxx' (ECDSA) to the list of known hosts.
    Permission denied (publickey).

    Should I add host with new port to the list of known hosts on my machine?

    • $ ssh localhost -p xxxx

      gives exacly same results plus it can’t create home/user/.ssh dir and add host to the list of known hosts

    • That just means that you haven’t set up your ssh key for your user on your droplet. It’s shown that you have connected to the ssh server on port xxxx.

      For the Firewall, you should set an Inbound rule. Type: Custom, Protocol:TCP, Port Range:XXXX, Sources: All ipV4

Helo LampreyOne,

Thanks a lot, for your tip.
I’ve been blocked to acces my droplet after the FIREWAL installation.
Then your solution was my salvation.


luciano viterbo