Skip to main content
Back to Category

SSH Connection Problem: Can't Connect to Server

SSH connection troubleshooting guide: Path.net firewall rules, Default Block, creating a filter rule for SSH port, and step-by-step troubleshooting.

Read time: 8 min Troubleshooting
sshconnection problemtroubleshootingfirewallport 22path.netserver access
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Introduction

On REXE Technology servers, the Path.net DDoS protection system works automatically based on rules. When an IP has no rules at all, all ports are open. However, if your IP has at least one rule, the system automatically applies Default Block and only the ports allowed by your rules stay open — all other ports are closed. For this reason, you need to create a filter rule that opens the SSH port (22) for SSH access.

If you can't establish an SSH connection, the most likely cause is that your IP has rules that trigger Default Block but no filter rule has been created for the SSH port (22). While Default Block is active, only the allowed ports are open — if SSH is not included, you cannot connect.

The Cause

Path.net firewall automatically applies Default Block when your IP has rules. In that case, only the allowed ports stay open:

Incoming Traffic → Path.net Firewall → Filter rule exists?
  → Yes: Pass traffic
  → No: Block traffic (DROP) — disallowed ports closed

When no filter rule has been created for the SSH port (TCP 22) — but the IP has other rules — SSH connection requests are blocked by Default Block and the connection times out.

Solution 1: Create a Filter Rule for SSH Port (Recommended)

To access SSH, you need to create a port-specific filter rule via Path Panel or the Rule Management product in your customer panel. This rule only opens SSH port (22) — all other ports remain closed with Default Block.

Steps

  1. Log in to Path Panel or the Rule Management product in your customer panel

  2. Click your server IP in IP Management

  3. Create New Rule with the following settings:

hljs yaml
Protocol: TCP
Destination Port: 22
Description: SSH access
  1. Wait for the rule to reach propagated status (2-5 minutes)

This rule only opens TCP port 22. All other ports remain closed with Default Block.

The rule creation screen has two modes: standard filter (you just enter protocol + port) and hard filter (you pick one of the game or application filters). For SSH the standard mode is enough. Both modes operate at Layer7 and track connection state. TCP Symmetric is only one of the filters selectable as a hard filter; a hard filter is used when application-specific packet inspection is needed.

Rule Propagation Time

It may take 2-5 minutes for your rule to propagate to all Path.net network points:

StatusDescription
pendingRule created, waiting to be sent
syncedSent to Path.net
propagatedDeployed to all points — connection possible
failedSending failed — retry

SSH connection may not be possible until the rule reaches "propagated" status. Be patient and track the rule status from the Path Panel.

Even if the panel shows the rule as not yet propagated (not updated), the rule has most likely already been deployed within 2-5 minutes. The status may update with a delay due to the panel's status-check interval or the time it takes for the rule to be applied across all nodes on the Path side (except ours). This is only a visual delay in the panel; the port has in fact already been opened in the system.

Additional Checks

If you still can't connect after creating the filter rule:

1. Verify SSH Service is Running

Access your server's VNC/KVM console from the REXE customer panel (my.rexe.tr):

hljs bash
# Check SSH service status
systemctl status sshd

# Start SSH service if not running
systemctl start sshd
systemctl enable sshd

2. Check SSH Port Number

SSH runs on port 22 by default. If you're using a different port, update the port in your filter rule:

hljs bash
# Check SSH configuration file
grep -i port /etc/ssh/sshd_config

3. Check Server Firewall

The local firewall on the server (iptables/ufw) may be blocking the SSH port:

hljs bash
# Check UFW status
ufw status

# Allow SSH
ufw allow 22/tcp

# Check iptables rules
iptables -L -n | grep 22

4. Verify You're Using the Correct IP Address

hljs bash
# Connection command
ssh root@SERVER_IP_ADDRESS

# With specific port
ssh -p 22 root@SERVER_IP_ADDRESS

Frequently Asked Questions

I created a rule but still can't connect

Make sure the rule has reached "propagated" status. Propagation can take 2-5 minutes.

I changed my SSH port, how do I update the rule?

Delete the existing rule and create a new one with the new port number.

Frequently Asked Questions

Why is my SSH connection being refused?

If your IP has rules, Default Block is automatically active and disallowed ports are closed. You need to create a filter rule for the SSH port (22) via Path Panel (x.rexe.tr) or the Rule Management product in your customer panel. When creating the rule, enter Protocol: TCP and Destination Port: 22 (standard filter mode). If your IP has no rules at all, all ports are open and the problem may be on the server side.

How long does the filter rule take to activate?

It takes 2-5 minutes for the rule to propagate to all network points. You can track the rule status from the Path Panel.

What authentication method should I use for SSH?

For security, SSH key pair (public/private key) authentication is recommended over passwords. Key-based authentication is much more resistant to brute-force attacks. Use ssh-keygen to generate a key pair and copy the public key to your server.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps