Why is a VPS port unreachable even when the guest firewall allows it?
The guest firewall is only one part of the access path. A missing listener, wrong bind address, provider restriction, NAT mapping or null route can still prevent access. Some service categories also require explicit provider approval for particular traffic.
Instructions
1. Confirm the service is listening
Inside the guest, inspect the exact protocol and address. A loopback-only listener is not publicly reachable even if a firewall allows the port.
sudo ss -lntpRead the relevant TCP listener and its bound address. Use an appropriate UDP check for a UDP service instead of assuming TCP results apply.
2. Test one intended endpoint
From an approved external Windows client, test the actual service port.
Test-NetConnection 203.0.113.10 -Port 22This example tests SSH. Substitute only the known intended port, not an uncontrolled range.
3. Review provider controls and terms
Check the selected VPS Networking, Security and Activity details. Confirm whether the IP is restricted, whether a mapping is required and whether the traffic is permitted. Contact support with the service reference, direction, protocol, port and test time; do not attempt to evade an imposed restriction.
Check the result
- The guest listener, address mapping and all applicable policies match the intended service.
- An authorised client can establish the application’s normal connection.
Troubleshooting
- The restriction concerns outbound mail
- Ask about the service’s mail policy and approved relay route; changing the guest firewall cannot override a provider block.
- A null route is present
- Read the recorded operation and request or use only the permitted removal process for the correct IP.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.