How to reset droplet firewall rules

Question

How do I reset droplet firewall rules after a misconfiguration?

KFSys · Answer

Heya, First thing to figure out is which firewall locked you out, because the fix is different: DigitalOcean Cloud Firewall (the managed one in the control panel) → you don’t need server access at all. Just go to Networking → Firewalls , edit the rules (or detach it from the Droplet), and you’re back in. Nothing to reset on the box itself. The OS firewall on the Droplet (iptables/ufw) → this is the one that blocks SSH and locks you out. That’s what the steps below fix. If you’re locked out: use the Recovery Console A bad iptables/ufw rule will block SSH, but the Recovery Console connects out-of-band (VNC, like plugging a monitor into the box), so it still works even with the network firewalled off. Open your Droplet in the control panel and launch it — full docs here: https://docs.digitalocean.com/products/droplets/how-to/recovery/recovery-console/ Note it needs a root password to log in (not your SSH key), so if you’ve never set one, do it from the control panel’s password reset first. Resetting iptables Once you’re in via the console, the key trick is to set the default policies to ACCEPT before you flush — if you flush while the default policy is DROP, you stay locked out: 1. Open the gates first iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT 2. Flush all rules and delete custom chains iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X At this point everything is wide open (no rules blocking anything), so SSH should work again. If you use ufw Simpler — reset it to defaults: ufw reset …or just ufw disable to turn it off entirely while you sort out the rules. Make it stick (important!) If you have iptables-persistent / netfilter-persistent installed, the old bad rules will come back on reboot unless you save the cleared state: netfilter-persistent save # or, directly: iptables-save > /etc/iptables/rules.v4 (On newer Ubuntu using nftables, nft flush ruleset clears everything instead.) Then rebuild sanely Once you can SSH in again, add rules back carefully — and always allow SSH before enabling anything: ufw allow OpenSSH ufw allow 'Nginx Full' # or 80/443 ufw enable Tip: when testing firewall changes over SSH, keep a Recovery Console session open in another tab so a mistake never fully locks you out again. Hope that gets you back in!

Bobby · Answer

Hi there, Depends on which firewall you are using. If you are using the DigitalOcean cloud firewall, go to Networking > Firewalls in the control panel, find the firewall attached to your Droplet, and edit the rules from there. Changes apply instantly at the network level without touching the Droplet itself. If you are using ufw directly on the Droplet and locked yourself out, use the Recovery Console under Settings in your Droplet to get in without SSH, then reset ufw: sudo ufw reset sudo ufw allow 22 sudo ufw enable If you are using iptables directly: sudo iptables -F sudo iptables -P INPUT ACCEPT sudo iptables -P FORWARD ACCEPT sudo iptables -P OUTPUT ACCEPT The cloud firewall approach is generally safer since you cannot accidentally lock yourself out by misconfiguring rules on the Droplet itself.

alexdo · Answer

Hi there, “Droplet firewall” can mean two different things, DigitalOcean’s Cloud Firewall (managed at the network edge, configured in the control panel) or a host-based firewall running inside the Droplet itself like ufw, firewalld, or raw iptables. Worth checking which one is actually the problem first, if you still have any way to reach the Droplet, run: iptables -L If that shows DROP policies or populated chains, a host-based firewall is filtering traffic. If it just shows empty ACCEPT chains, the Cloud Firewall attached in your DigitalOcean account is more likely the cause. If it’s the Cloud Firewall , go to Networking > Firewalls in the control panel, open the firewall attached to the Droplet, and edit or remove the inbound rules that are blocking you. This is worth trying first regardless, since it is managed entirely through the control panel and isn’t affected by whatever state the Droplet’s own networking is in. If it’s a host-based firewall , the reset commands differ by tool. For ufw: sudo ufw disable For firewalld: sudo systemctl stop firewalld sudo systemctl disable firewalld For raw iptables: sudo iptables -P INPUT ACCEPT sudo iptables -P OUTPUT ACCEPT sudo iptables -P FORWARD ACCEPT sudo iptables -F Repeat the iptables commands with ip6tables if you also have IPv6 rules in place. The part worth knowing before you try any of this: if the misconfiguration blocked SSH entirely, the normal Web Console button in the control panel will not save you, DigitalOcean’s docs are explicit that it connects over the network the same way any SSH client does, so it hits the same block. What does work regardless of network state is the separate Recovery Console, a VNC-based out-of-band console under the Droplet’s Settings tab, in the Recovery console section. It only supports password login though, so if you normally log in with SSH keys and have never set a root or sudo password, you will need to use Reset Root Password on that same Settings tab first before the Recovery Console will let you in. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

How to reset droplet firewall rules

Related questions

How do I know if my Nginx config is actually using HTTP/2 or just claims to?

Why does my email look fine in Gmail but broken in Outlook, and how do I test this properly before sending?

Docker Networking Explained: How Containers Talk to Each Other

How do I debug a broken deployment on a DigitalOcean Droplet when I have no idea what went wrong?

How to optimize Nginx reverse proxy caching for media streaming apps?

Any good resources to learn Linux commands in an interactive way?

Can I utilize ports 25 465 and 587? I want to setup postfix email server on ubuntu

problems when I try to run my project in the droplet

Problems with odoo and wkhtmltopdf in Kubernetes

How do you handle automated cost monitoring and alerts on DigitalOcean?

What’s a good learning path for deploying real projects on DigitalOcean?

What's the best way to get comfortable with the Linux command line as a beginner?

Report this

How to reset droplet firewall rules

Related questions

How do I know if my Nginx config is actually using HTTP/2 or just claims to?

Why does my email look fine in Gmail but broken in Outlook, and how do I test this properly before sending?

Docker Networking Explained: How Containers Talk to Each Other

How do I debug a broken deployment on a DigitalOcean Droplet when I have no idea what went wrong?

How to optimize Nginx reverse proxy caching for media streaming apps?

Any good resources to learn Linux commands in an interactive way?

Can I utilize ports 25 465 and 587? I want to setup postfix email server on ubuntu

problems when I try to run my project in the droplet

Problems with odoo and wkhtmltopdf in Kubernetes

How do you handle automated cost monitoring and alerts on DigitalOcean?

What’s a good learning path for deploying real projects on DigitalOcean?

What's the best way to get comfortable with the Linux command line as a beginner?