Server blocking after enabling ufw

Question

I recently leased a Ubuntu 22.04 VPS server from a data centre in France. My office PC that links to this server is in Ireland.

My mobile internet IP seems to be static, i.e. it is the same from day to day - at least recently, as I haven't been checking before this.

After doing the basics, e.g. establish new user sudo, update system, etc I enabled ufw and established general access to port 80 and to port 22 but only from my own IP address, xxx.xxx.xxx.xxx/24.

The code went like this:

$ sudo ufw allow 80

$ sudo ufw allow from xxx.xxx.xxx.xxx/24 to any port 22 proto tcp

$ sudo ufw enable

Now after doing this, I exited the server and tried logging in from my home PC. I successfully logged in.

Today, I try to log in again but find my efforts blocked:

$ sudo ssh -p 22 [email protected]
ssh: connect to host xxx.www.yyy.zzz port 22: Connection timed out

A curl test shows no connection either:

$ curl -v telnet://xxx.www.yyy.zzz:22
*   Trying xxx.www.yyy.zzz:22...
* connect to xxx.www.yyy.zzz port 22 failed: Connection timed out
* Failed to connect to xxx.www.yyy.zzz port 22 after 129791 ms: Connection timed out
* Closing connection 0
curl: (28) Failed to connect to xxx.www.yyy.zzz port 22 after 129791 ms: Connection timed out

What am I doing wrong here ?

Surely if I coded it incorrectly, I would have been blocked on the login just afterwards rather than a day later . . .

I am wondering . . . must I explicitly allow ssh access on ufw before applying the restriction on calling IPs, e.g.

$ sudo ufw allow 80

$ sudo ufw allow ssh

$ sudo ufw allow from xxx.xxx.xxx.xxx/24 to any port 22 proto tcp

$ sudo ufw enable

EDIT

I acted on suggestions that my IP may be dynamic - although my IP seems to be the same over the last few days. I could have tried the IP address without the /24 subnet but I didn't want the hassle of reinstalling and reconfigging the server all over again. So I just enabled ssh on ufw via

  sudo ufw allow ssh

This allows ssh network connections and SFTP transfers - though without restriction on the IP of the client device. Ideally i'd like to restrict the IP access to my server to only 2 machines, my home workstation and some mobile device.

Answer 1

The IP/24 is most likely your local subnet - private subnet. Something like 192.168.0.50/24. Your ISP will own any number of IPs from any number of public subnets they may own. If your home has a dynamic IP, I would suggest you don’t block port 22 based on IP. Some ways you can secure your server are:

1. Disallow root logins and have strong password for all ssh-enabled users
2. Add 2-factor authentication to SSH using pam.d - see “ssh google Authenticator” for an example
3. Require a valid VPN session and allow ssh only from within the VPN tunnel - this adds complexity with arguably very little security for a single internet facing server like yours
4. Use only ssh keys and disable password authentication altogether

Actually options 1+2 and potentially +4 will be good enough. You do not need to block off port 22 from the world, especially since you have a dynamic IP (assumption here, but an educated guess).

Answer 2

As others have said, allowing access to your mobile device is likely to be difficult via IP. A better option would be to configure something like Wireguard as a VPN, and then your mobile connects to the VPN and uses a private IP to connect to the server. This way you only need to expose the Wireguard port to the world, and you gain additional security.