SSH firewall and blocked IPs

What this is#

To protect Linux VPS from brute-force attacks, we run an SSH firewall on port 22 across our network. It counts failed login attempts with an incorrect password on port 22 and temporarily blocks the IP they come from. Sometimes that IP is your own, which is why you can suddenly find yourself unable to SSH in.

This applies to Linux VPS. Windows VPS connects over RDP, not SSH. (Curious how the system works underneath, and why it beats a local fail2ban? See How our SSH brute-force firewall works.)

Why your IP got blocked#

The firewall counts failed logins with an incorrect password on port 22, and blocks the IP after too many in a short time. Correct logins don't count, so this is specifically about wrong passwords piling up. Common innocent causes:

• Retrying a password you're not sure of, or a saved password that's out of date.
• A script or automated job (rsync, a backup, a CI runner, or anything using a tool like sshpass) that signs in with a password that's wrong or has changed, and keeps retrying.
• An SSH client set to use the wrong key, which then falls back to failed password prompts.

While your IP is blocked, SSH from it times out or is refused, even though the VPS itself is fine.

Unblock or whitelist your IP#

The quickest path is the My VPS is Down page (https://vpsdime.com/myvpsisdown):

• When it runs its checks, it detects whether your own current IP is blocked and whitelists it automatically. Wait about two minutes, then try connecting again.
• It also has a "Whitelist an IP from our SSH firewall" form. Enter any IP (for example your home or office IP) and it's whitelisted on every node, so it stays unblocked. You can whitelist up to 10 IPs. After that, open a ticket to whitelist more.

Whitelisting an IP also lifts its block if it was currently banned.

Prevent it happening again#

• Use SSH key authentication instead of a password. This is the best fix. With a key there's no password to get wrong, so a failed-password ban can't happen. Add your key on the SSH Keys page and select it when you deploy or reinstall, or add it to the VPS yourself. For automated jobs (rsync, backups, cron), give the job its own key rather than a password, instead of a tool like sshpass.
• Change your SSH port. Running SSH on a port other than 22 keeps you off this firewall entirely. The lockout-safe procedure is in How can I change my SSH port? (make sure the new port is open before you disconnect).
• Whitelist a fixed IP. If you always connect from the same home or office IP, whitelist it once (above) so it's never blocked.

Troubleshooting#

• I whitelisted my IP but still can't connect. Give it a couple of minutes, then retry. If it still fails, your IP may have changed (many home connections use dynamic IPs), so whitelist the new one, or run the troubleshooter again. If SSH still won't connect, the cause is probably something other than the firewall.
• I've used all 10 whitelist slots. Open a ticket and we'll help.
• This is a Premium or Windows VPS. The port-22 SSH firewall is for Linux VPS. For a Windows VPS you connect over RDP, so use the troubleshooter.

Still need help?#

You can open a support ticket. So we can help on the first reply, it's worth mentioning:

• the VPS hostname or IP,
• the IP you're connecting from (check a "what is my IP" site if you're not sure),
• what happens when you try to SSH (timeout, refused, and so on).

Related questions#

• "Why can't I SSH into my VPS?"
• "My IP is blocked, how do I unblock it?"
• "How do I whitelist my IP on the SSH firewall?"
• "Why does SSH suddenly time out?"
• "Does a wrong password get my IP blocked?"
• "How do I stop getting blocked on port 22?"
• "Should I use SSH keys to avoid getting banned?"