How to Use the ufw Command to Restrict SSH Access to a Specific IP Address

Why Restrict SSH Access?

Secure Shell (SSH) is the standard protocol for remotely managing Linux servers. By default, most SSH configurations listen on port 22 and accept connection attempts from any IP address on the internet. This leaves your server vulnerable to continuous brute-force dictionary attacks and zero-day exploits.

One of the most effective ways to secure a Linux server is to use a firewall to drop all SSH traffic unless it originates from a trusted, static IP address (such as your corporate office or a secure VPN node).

In Ubuntu and Debian-based distributions, the easiest way to configure this is using UFW (Uncomplicated Firewall).

Step 1: Check Current UFW Status

Before making changes, verify that UFW is installed and check its current status. Run the following command:

sudo ufw status

If it says inactive, you will need to enable it later. If it is active, take note of any existing rules allowing port 22.

CRITICAL WARNING: If you are configuring a remote server, do not enable UFW yet, and do not delete existing SSH rules until your new, restricted rule is firmly in place. Otherwise, you will immediately lock yourself out of the server.

Step 2: Delete Existing Open SSH Rules

If you have a rule that allows SSH from anywhere, you must delete it. First, list your rules with numbers:

sudo ufw status numbered

If you see a rule like [ 1] 22/tcp ALLOW IN Anywhere, delete it by specifying the rule number:

sudo ufw delete 1

(Replace “1” with the actual rule number on your system. Remember that rule numbers shift after a deletion, so check the list again if you need to delete an IPv6 rule as well.)

Step 3: Allow SSH from a Specific IP Address

To restrict SSH access to a single, trusted IP address (for example, 203.0.113.50), use the following syntax:

sudo ufw allow from 203.0.113.50 to any port 22 proto tcp

This command instructs UFW to accept incoming TCP traffic on port 22 only if the source IP matches the one provided. All other IP addresses will be silently dropped.

Allowing a Subnet (Optional)

If your office uses a block of IP addresses, you can allow an entire CIDR subnet instead of a single IP. For example, to allow the entire 192.168.1.0/24 local subnet:

sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp

Step 4: Enable and Reload UFW

Once you are absolutely certain that your trusted IP is permitted on port 22, enable UFW (if it isn’t already):

sudo ufw enable

If UFW was already active, reload it to ensure the new rules take immediate effect:

sudo ufw reload

Step 5: Verify the Configuration

Finally, run a status check to verify the active rules:

sudo ufw status

You should see output similar to this:

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       203.0.113.50

To safely test the configuration, open a new terminal window (do not close your current active SSH session) and attempt to SSH into the server from the allowed IP address. If it connects successfully, your firewall restriction is working correctly.