Locked out after ufw enable

You ran ufw enable or moved SSH to a new port, and now ssh just hangs. The server is fine. The firewall is dropping your connection, and you need a way in that doesn't go through SSH.

Published 30 October 2026. UFW on Ubuntu Server 22.04 and 24.04 or Debian 11 to 13, on a VPS or cloud server whose provider offers a console.

• What usually went wrong
• Get in through the provider's console
• Turn the firewall off, or fix the rule
• Turn it back on safely
• Next time: schedule the undo first
• Keep a second session open

What usually went wrong

A UFW lockout almost always comes from one of these:

• UFW was enabled before any rule allowed SSH, so the default deny policy dropped it.
• SSH was moved to a new port, but UFW still only allows the old one.
• The SSH rule only allows one source address, and you are now connecting from a different one.
• A limit rule blocked you because your address opened 6 or more connections within 30 seconds.

The last one fixes itself. Wait a minute and try once. If ssh -v your.server.example still stops at the connect step with a timeout, the packets are being dropped, and you need another way in.

Get in through the provider's console

Most VPS and cloud providers give you a console in their web dashboard. It may be called web console, VNC console, serial console or recovery console. It shows the server's own screen, as if a keyboard and monitor were plugged in. That connection doesn't go over the network to your server's SSH port, so the firewall doesn't block it.

Open the server in your provider's dashboard and look for a console button. Log in there with a user name and password.

That last part catches people out. Your SSH key doesn't work at a console, because nothing on the console asks for one. If your user has no password, look in the dashboard for a feature to reset the root password or boot a rescue system, or ask the provider's support for help.

Turn the firewall off, or fix the rule

Once you have a shell, the fastest way back is to turn UFW off:

sudo ufw disable

This unloads the rules and stops UFW from starting at boot. Your saved rules are kept. Now SSH from your own machine again. When that works, close the console and do the rest over SSH, where you can copy and paste.

If you'd rather keep the firewall up, fix the rule directly from the console instead. First check which port sshd really listens on:

sudo ss -tlpn | grep sshd

Then allow that port and check the result:

sudo ufw allow 2222/tcp
sudo ufw status numbered

If an address-restricted SSH rule is the problem, add a rule for your new address or a plain rule for the port. Remove the old rule by number with sudo ufw delete NUM once the new one works.

Turn it back on safely

With SSH allowed again, enable the firewall the careful way. Check the rules first:

sudo ufw show added
sudo ufw enable
sudo ufw status verbose

Then test a new SSH connection from another terminal before you close the one you have. The full order is in set up UFW without losing SSH.

Next time: schedule the undo first

The trick is to plan for failure before you make the change. Schedule a command that turns the firewall off in a few minutes. If the change works, you cancel it. If it locks you out, you wait, and the server lets you back in by itself.

at runs a command once at a set time. Install it if it's missing:

sudo apt install at

Schedule the undo, then make the change:

echo "/usr/sbin/ufw disable" | sudo at now + 5 minutes
sudo ufw enable

Now open a second terminal and connect again. If it works, cancel the undo. List the pending jobs, then delete yours by its job number:

sudo atq
sudo atrm 4

If the new connection fails, wait the five minutes. The firewall goes off, you get back in, and you fix the rule without needing the console.

Without at, a sleep does the same job. Run it as root inside tmux or screen, so it keeps running if your SSH connection drops:

sudo -i
sleep 300 && ufw disable

Make the change from another window. If all is well, go back and press Ctrl+C to cancel the sleep.

Keep a second session open

The same applies to SSH changes. Changing the port, turning off password login or editing AllowUsers can all lock you out the same way. Allow the new port in UFW before you restart sshd, and see changing the SSH port and SSH hardening without lockout for those steps.

Sources

1. ufw(8) manual page, Ubuntu 24.04 (manpages.ubuntu.com)
2. at(1) manual page, Ubuntu 24.04 (manpages.ubuntu.com)
3. Ubuntu Server documentation: Firewall