SSH Connection Problem: Can't Connect to Server
SSH connection troubleshooting guide: Path.net firewall rules, Default Block, creating a filter rule for SSH port, and step-by-step troubleshooting.
Table of Contents
Introduction
On REXE Technology servers, the Path.net DDoS protection system works automatically based on rules. When an IP has no rules at all, all ports are open. However, if your IP has at least one rule, the system automatically applies Default Block and only the ports allowed by your rules stay open — all other ports are closed. For this reason, you need to create a filter rule that opens the SSH port (22) for SSH access.
If you can't establish an SSH connection, the most likely cause is that your IP has rules that trigger Default Block but no filter rule has been created for the SSH port (22). While Default Block is active, only the allowed ports are open — if SSH is not included, you cannot connect.
The Cause
Path.net firewall automatically applies Default Block when your IP has rules. In that case, only the allowed ports stay open:
Incoming Traffic → Path.net Firewall → Filter rule exists?
→ Yes: Pass traffic
→ No: Block traffic (DROP) — disallowed ports closed
When no filter rule has been created for the SSH port (TCP 22) — but the IP has other rules — SSH connection requests are blocked by Default Block and the connection times out.
Solution 1: Create a Filter Rule for SSH Port (Recommended)
To access SSH, you need to create a port-specific filter rule via Path Panel or the Rule Management product in your customer panel. This rule only opens SSH port (22) — all other ports remain closed with Default Block.
Steps
-
Log in to Path Panel or the Rule Management product in your customer panel
-
Click your server IP in IP Management
-
Create New Rule with the following settings:
Protocol: TCP
Destination Port: 22
Description: SSH access
- Wait for the rule to reach propagated status (2-5 minutes)
This rule only opens TCP port 22. All other ports remain closed with Default Block.
The rule creation screen has two modes: standard filter (you just enter protocol + port) and hard filter (Layer7 filters like TCP Symmetric). For SSH the standard mode is enough. TCP Symmetric is a hard filter that performs Layer7 filtering, and it should only be enabled for highly sensitive applications.
Rule Propagation Time
It may take 2-5 minutes for your rule to propagate to all Path.net network points:
| Status | Description |
|---|---|
| pending | Rule created, waiting to be sent |
| synced | Sent to Path.net |
| propagated | Deployed to all points — connection possible |
| failed | Sending failed — retry |
SSH connection may not be possible until the rule reaches "propagated" status. Be patient and track the rule status from the Path Panel.
Even if the panel shows the rule as not yet propagated (not updated), the rule has most likely already been deployed within 2-5 minutes. The status may update with a delay due to the panel's status-check interval or the time it takes for the rule to be applied across all nodes on the Path side (except ours). This is only a visual delay in the panel; the port has in fact already been opened in the system.
Additional Checks
If you still can't connect after creating the filter rule:
1. Verify SSH Service is Running
Access your server's VNC/KVM console from the REXE customer panel (my.rexe.tr):
# Check SSH service status
systemctl status sshd
# Start SSH service if not running
systemctl start sshd
systemctl enable sshd
2. Check SSH Port Number
SSH runs on port 22 by default. If you're using a different port, update the port in your filter rule:
# Check SSH configuration file
grep -i port /etc/ssh/sshd_config
3. Check Server Firewall
The local firewall on the server (iptables/ufw) may be blocking the SSH port:
# Check UFW status
ufw status
# Allow SSH
ufw allow 22/tcp
# Check iptables rules
iptables -L -n | grep 22
4. Verify You're Using the Correct IP Address
# Connection command
ssh root@SERVER_IP_ADDRESS
# With specific port
ssh -p 22 root@SERVER_IP_ADDRESS
Frequently Asked Questions
I created a rule but still can't connect
Make sure the rule has reached "propagated" status. Propagation can take 2-5 minutes.
I changed my SSH port, how do I update the rule?
Delete the existing rule and create a new one with the new port number.
Related Articles
RDP Connection Problem: Can't Connect to Windows Server
RDP connection troubleshooting guide: Path.net firewall rules, Default Block, creating a filter rule for RDP port, and step-by-step troubleshooting.
How to Run an MTR Test and Submit Results to Support
Guide to running MTR network tests with WinMTR and Linux MTR, creating ICMP filter rules, and submitting results to support. Diagnose packet loss and latency.
How to Capture Packets (PCAP) and Submit to Support
Packet capture guide using Linux tcpdump and Windows Wireshark. Create PCAP files for network analysis, troubleshoot connectivity issues, and submit to support.