Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I made changes to my iptables config and now SSH is refusing all connections. Can I fix this without contacting my hosting company?

Long Version

Ok, this is most likely 100% my own fault...

In preparation of moving a website to a dedicated server, we got a new hosted machine running CentOS 5.6. The machine has iptables pretty locked down, only allowing ssh(22) and http(80) but we also needed it to accept FTP over port 20 en 21.

This afternoon I added to lines to my iptables in order to accept incoming connection to ports 20 and 21. At first that didn't work because there was a reject allline above the lines I added for ftp. So I moved that line down to the bottom, saved and restarted iptables and ftp was working.

2 hours later, when I try to connect again, port 22: Connection refused Same for http.

So I can't get to the server through SSH, is there any way I can fix this without contacting my hosting company?

share|improve this question
up vote 11 down vote accepted

Unfortunately, no. Not unless you have some other management interface available like a remote serial console, iDRAC, iLO, etc. Chalk it up to experience and remember to test settings before you log out next time ;)

share|improve this answer
Or if you experiment with iptables make sure that you temporarily set a cron job that resets the ruleset every 15 minutes. – mailq Aug 12 '11 at 19:10
Lesson learned :) – Jannemans Aug 12 '11 at 19:24
How would you enable the SSH port 22 using iDRAC? – terrid25 Aug 31 '11 at 13:39
@terrid25 you would login using the serial console listening on the serial port that iDRAC gives you access to. you can then fix iptables and be on your merry way. of course, if your out-of-band stuff isn't set up with remote console and such you'll be just as stuck as your friend with no remote management at all. – Michael Lowman Sep 1 '11 at 3:28

Assuming you can still ftp to the server, and you can log in as root via ftp (unlikely and ordinarily ill-advised) into a non-chrooted (etc) environment:

Put a file in /etc/cron.d with these contents:

* * * * * root /sbin/service iptables stop 
share|improve this answer
This helped me, because I can remotely connect a recovery image and access the filesystem. – DanFromGermany Jun 7 '15 at 11:57

As per these instructions, you can also append:


... to your WHM url. I did that and ended up with a URL:


It reset my iptables and everything was good with the world again. :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.