Loading...

VONDS ©

Lab 128: Firewall Troubleshooting for SSH Access

Back to Lab Index

Restore inbound SSH when the service is listening on TCP/22 but clients still get “port closed.” Prove sshd is listening, confirm firewalld is enforcing policy, inspect the active zone’s allowed services, then allow ssh permanently and reload firewalld.

firewalld ssh zones incident troubleshooting

Scenario

A teammate says, “The box is up, but nobody can SSH into it anymore.” You have console access. Your job is to restore inbound SSH quickly.

Operator context

SSH should be running and listening on port 22 . Interface and link are good. The failure is caused by firewall policy and a missing ssh allowance in the active zone.

Objective

  • Prove sshd is listening on TCP/22.
  • Confirm firewalld is active.
  • Identify the active zone and inspect allowed services.
  • Allow SSH permanently and reload firewall rules.
  • Verify SSH is now permitted by policy.

Concepts

  • “Port closed” can be a daemon problem or a firewall problem.
  • Prove the service is listening first (avoid chasing policy blindly).
  • firewalld enforces policy by zone; rules must apply to the correct zone and interface.
  • Use --permanent for persistence and --reload to apply changes to runtime.

Walkthrough

Step 1 : Confirm sshd is listening on TCP/22.
Command 
ss -lntp | grep ':22'

You want to see listeners on 0.0.0.0:22 and/or [::]:22 owned by sshd . That proves the daemon is up and bound correctly.

Step 2 : Confirm firewalld is enforcing policy.
Command 
sudo firewall-cmd --state

If it returns running , inbound policy is being enforced by firewalld.

Step 3 : Identify the active zone and its interfaces.
Command 
sudo firewall-cmd --get-active-zones

This tells you which zone is active and which interface is assigned to it. You should validate you are changing policy in the correct zone.

Step 4 : Inspect allowed services in the active zone.
Command 
sudo firewall-cmd --list-services

In this outage, ssh is missing from the allowed services list, so inbound TCP/22 is blocked.

Step 5 : Allow SSH permanently.
Command 
sudo firewall-cmd --permanent --add-service=ssh
Why permanent

--permanent updates the saved configuration so the fix survives reloads and reboots. You still need a reload for it to take effect immediately.

Step 6 : Reload firewalld to apply changes.
Command 
sudo firewall-cmd --reload

This applies the permanent configuration to the running firewall.

Step 7 : Confirm SSH is now allowed.
Command 
sudo firewall-cmd --list-services

You should now see ssh in the services list. At this point, remote SSH attempts should succeed.

Breakpoints

sshd not listening

If there is no listener on :22 , fix the service first: sudo systemctl status sshd and sudo systemctl start sshd .

Wrong zone or interface not assigned

If ssh is allowed but still blocked, confirm the interface is in the expected zone with sudo firewall-cmd --get-active-zones and inspect the full zone config with sudo firewall-cmd --list-all .

SSH allowed but still unreachable

Check SELinux policy, upstream firewalls, or cloud security groups, and confirm the client targets the correct IP and port.

Need a temporary fix only

If you only need a short-term restore, omit --permanent . For real systems, do both: immediate fix plus persistent config.

Cleanup checklist

If you need to revert the change after the lab, remove the SSH service allowance and reload firewalld.

Commands 
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload
sudo firewall-cmd --list-services
Success signal

The ssh service is present when you want access, and absent when you revert, and the zone policy reflects the intended state.

Reference

  • ss -lntp : List listening TCP sockets with owning process.
    • -l : Show listening sockets only.
    • -n : Show numeric addresses and ports.
    • -t : TCP only.
    • -p : Show process using the socket (requires privileges).
  • firewall-cmd --state : Show whether firewalld is running.
  • firewall-cmd --get-active-zones : Show active zones and interface bindings.
  • firewall-cmd --list-services : List allowed services in the active zone.
  • firewall-cmd --permanent --add-service=ssh : Allow SSH in the permanent zone configuration.
    • --permanent : Writes to saved config, not runtime.
    • --add-service=ssh : Enables the predefined SSH service definition.
  • firewall-cmd --reload : Reloads firewall rules and applies permanent config to runtime.
  • firewall-cmd --permanent --remove-service=ssh : Removes SSH from the permanent allowed services list.
  • firewall-cmd --list-all : Displays full zone configuration (services, ports, sources, interfaces, rich rules).