"Troubleshooting Cloud Firewall Issues"

Cloud firewall misconfigurations are one of the most common causes of connectivity problems. When a service suddenly becomes unreachable or you cannot SSH into your server, the firewall is often the first place to check. This guide covers the most common cloud firewall issues and how to resolve them.

Problem: Cannot Connect via SSH

Symptoms

• SSH connection attempts time out or are refused.
• You were able to connect previously but now cannot.
• Other services on the server (like a website) may or may not work.

Possible Causes and Solutions

1. SSH port is not allowed in the firewall.

Check your cloud firewall rules for an inbound rule allowing TCP port 22 (or your custom SSH port). If the rule is missing, add it:

If your SSH rule restricts access to a specific IP address and your IP has changed (common with residential internet connections), you will be locked out. Update the source IP in your firewall rule to your current IP address.

To find your current public IP, search "what is my IP" in any web browser.

3. No firewall rule group assigned to the server.

If no rule group is assigned, the server may be using a default deny policy. Assign a rule group with appropriate SSH access.

Recovery Method

If you are locked out of SSH, use the web console in your Data Mammoth dashboard:

Problem: Website Not Loading

Symptoms

• Visitors cannot access your website.
• Browser shows "connection timed out" or "connection refused."
• SSH access may or may not work.

Possible Causes and Solutions

1. HTTP/HTTPS ports not allowed.

Ensure your firewall rules include:

2. Wrong port number.

If your web application runs on a non-standard port (e.g., 8080, 3000), make sure a firewall rule exists for that specific port.

3. Web server not running.

The firewall may be correctly configured, but the web server service (Nginx, Apache) might be stopped. SSH into the server and check:

sudo systemctl status nginx

Problem: Application Cannot Connect to Database

Symptoms

• Your application shows database connection errors.
• The database server is running, but the application cannot reach it.

Possible Causes and Solutions

1. Database port not allowed from the application server's IP.

If the database is on a separate server, ensure a firewall rule allows the application server's IP to connect:

2. Application server IP changed.

If you provisioned a new application server, its IP address is different from the one in your firewall rule. Update the source IP.

3. Database and application on the same server.

If both services are on the same server, no cloud firewall rule is needed — the application connects via localhost. Make sure the database is configured to listen on 127.0.0.1.

Problem: Game Server Not Visible in Server Browser

Symptoms

• Players cannot find or connect to your game server.
• The game server software is running, but it does not appear in the game's server browser.

Possible Causes and Solutions

1. Game ports not opened.

Each game uses specific ports. Ensure you have rules for the correct protocol (TCP, UDP, or both) and port number. See Common Firewall Rules for game-specific port listings.

2. Query port not opened.

Many game servers use a separate "query port" for server browser listings. This is often a different port from the main game port and may use UDP. Check your game's documentation for the query port and add a rule for it.

3. Wrong protocol.

Some game ports require UDP, not TCP. If you only allowed TCP, UDP traffic is still blocked. Double-check the required protocol for each port.

Problem: Rules Changed but Not Taking Effect

Symptoms

• You added or modified firewall rules, but traffic behavior has not changed.
• Old rules seem to still apply.

Possible Causes and Solutions

1. Rule group not assigned to the server.

Creating rules in a rule group does not apply them automatically. You must assign the rule group to your server:

2. Conflicting rules.

If you have multiple rules for the same port, a deny rule may take precedence over an allow rule (or vice versa, depending on rule order). Review all rules in the group for conflicts.

3. Software firewall blocking traffic.

Even if the cloud firewall allows traffic, a software firewall on the server (iptables, ufw, firewalld) may be blocking it. SSH into the server and check:

sudo ufw status

or:

sudo iptables -L -n

4. Browser cache.

If testing web access, clear your browser cache or use an incognito/private window. Some browsers cache connection failures.

Problem: Everything Is Blocked After Creating a Rule Group

Symptoms

• After creating and assigning a new rule group, all connectivity is lost.
• Cannot access SSH, web, or any other service.

Cause

A new, empty rule group implements a default deny policy. If you assigned the group before adding any allow rules, all inbound traffic is blocked.

Solution

Prevention: Always add your essential rules (at least SSH) to a rule group before assigning it to a server.

Problem: Outbound Traffic Blocked

Symptoms

• Your server cannot download updates, connect to external APIs, or send email.
• Inbound connections work fine.

Possible Causes and Solutions

1. Outbound rules configured.

Most cloud firewall setups do not restrict outbound traffic by default. If you added outbound deny rules, they may be blocking your server's ability to reach external services.

Review outbound rules and remove or modify overly restrictive ones.

2. Software firewall restricting outbound traffic.

Check iptables/ufw for outbound rules:

sudo iptables -L OUTPUT -n

General Troubleshooting Steps

When you encounter a connectivity issue, follow this systematic approach:

What to Do Next

• How to Set Up Cloud Firewall Rules — Review the basics of rule creation.
• Common Firewall Rules — Copy proven rule sets for your server type.
• Cloud Firewall Best Practices — Avoid common mistakes.
• Troubleshooting — Cannot Connect via SSH — Additional SSH troubleshooting.