Britixo CRMBritixo CRMEnterprise Help Centre
Ctrl K
Shared server guidance · Question & answer

How do I allow SSH from one administrator IP using UFW?

On a server already managed by active UFW, an allow rule can restrict SSH access to a specific source IP and TCP port. This rule adds access; it does not remove broader existing rules. Confirm the administrator’s public egress address and the server’s actual SSH listening port before applying it.

IntermediateLinux servers with UFW already active

Britixo Help Centre · Updated

Go to the answer

Before you start

  • Working provider console or independent recovery access.
  • A second terminal for testing.
  • A verified client source IP; the example 198.51.100.20 must be replaced.

Instructions

1. Inspect current access

Read the active rules and listener first. Port 22 is only the example; use the port that the running SSH service actually exposes. Retain the current session during the entire change.

Remote Linux shell
sudo ufw status numbered
sudo ss -lntp

These checks establish the current access path before editing policy.

2. Preview the exact rule

Substitute the approved administrator address and SSH port. A dry run shows generated changes without applying them.

Remote Linux shell
sudo ufw --dry-run allow proto tcp from 198.51.100.20 to any port 22

Limits the example allow rule to TCP from one IPv4 source.

3. Apply and verify the narrow addition

Only after the preview matches the plan, apply the same rule. Open a fresh SSH connection from the authorised client before considering removal of any older rule.

Remote Linux shell
sudo ufw allow proto tcp from 198.51.100.20 to any port 22
sudo ufw status numbered

Adds the selected rule and then displays the current policy.

Check the result

  • A separate login from the approved address succeeds while the original session remains available.
  • Any broader SSH rules are reviewed separately; adding a restricted rule does not override an existing broad allow.

Troubleshooting

The source IP changes on another network or VPN
Verify the new public egress address and agree a stable management path. Do not widen SSH to every address merely to bypass an identity mismatch.

Official references

Use the documentation for your installed version when a flag, service name or platform feature differs.