If your services suddenly become unreachable even though the server is running, the firewall may be blocking legitimate traffic. This is common after firewall configuration changes, server migrations, or security hardening. This guide helps you identify and fix overly restrictive firewall rules.

Symptoms

• Website returns connection timeout (not a 403 or 500 error).
• SSH connection times out or is refused.
• Application ports are unreachable from outside the server.
• Services work when accessed locally on the server but not remotely.

Step 1 — Verify the Issue Is Firewall-Related

From your local machine, test connectivity:

# Test web ports
nc -zv 203.0.113.10 80
nc -zv 203.0.113.10 443
Test SSH
nc -zv 203.0.113.10 22

If these time out, the firewall or network is blocking traffic.

From the server itself (via web console if SSH is blocked):

# Check if the service is listening
ss -tuln | grep :80
ss -tuln | grep :443
ss -tuln | grep :22

If the service is listening locally but unreachable remotely, the firewall is likely the cause.

Step 2 — Check Firewall Status

UFW (Ubuntu/Debian)

sudo ufw status verbose

Look for rules that should allow the blocked traffic. If you see Status: active but no rules for the needed ports, traffic is being denied by the default policy.

firewalld (CentOS/AlmaLinux)

sudo firewall-cmd --list-all

Check the services and ports sections for the required entries.

iptables (Direct)

sudo iptables -L -n --line-numbers

Look for DROP or REJECT rules that match the blocked traffic.

Step 3 — Fix the Rules

Allow Web Traffic

# UFW
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
firewalld
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Allow SSH

# UFW
sudo ufw allow 22/tcp
firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Allow Custom Port

# UFW
sudo ufw allow 8080/tcp
firewalld
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

Step 4 — Emergency: Disable Firewall Temporarily

If you are locked out and cannot determine the blocking rule, temporarily disable the firewall to restore access:

Via Web Console:

# UFW
sudo ufw disable
firewalld
sudo systemctl stop firewalld
iptables
sudo iptables -F

Important: This removes all firewall protection. Re-enable and properly configure the firewall as soon as possible.

Common Firewall Mistakes

1. Enabling Firewall Without SSH Rule

The most common lockout: enabling a firewall without first allowing SSH.

Prevention: Always add SSH before enabling:

sudo ufw allow ssh
sudo ufw enable

2. Blocking All Incoming by Default

Setting default deny incoming without adding any allow rules blocks everything.

Fix: Add rules for all needed services before or immediately after setting the default policy.

3. Docker Bypassing UFW

Docker modifies iptables directly, potentially bypassing UFW rules. See Installing Docker & Docker Compose for Docker-specific firewall configuration.

4. Fail2ban Blocking Your IP

Fail2ban may have banned your IP address after failed login attempts.

Check:

sudo fail2ban-client status sshd

Unban your IP:

sudo fail2ban-client set sshd unbanip YOUR_IP_ADDRESS

5. IP Whitelist Too Restrictive

If you restricted SSH to specific IPs and your IP changed:

# Add your new IP
sudo ufw allow from NEW_IP to any port 22

Step 5 — Verify the Fix

After updating firewall rules, test from your local machine:

# Test web
curl -I http://203.0.113.10
Test SSH
ssh [email protected]
Test specific port
nc -zv 203.0.113.10 8080

Firewall Configuration Best Practices

What to Do Next

• Server Firewall Hardening Guide — Proper firewall configuration.
• Using the Web Console — Access when SSH is blocked.
• Website Down — Quick Diagnosis — Full troubleshooting flow.
• How to Submit a Support Ticket — Get expert help.