How to Change Linux SSH Port Safely (with Firewall Configuration)
This guide explains how to change the default Linux SSH port (22) to a custom port, while ensuring the new port remains accessible through the firewall. Written according to iCoreHosting Knowledgebase structure.
Table of Contents
- Service Direction / Introduction / Scope
- Description of Content / Step-by-Step Guide
- Common Mistakes
- Responsibility Breakdown
- FAQ
- Summary
- Use Case
1. Service Direction / Introduction / Scope
This article provides a clear and safe method for changing the SSH port on Linux systems (CentOS, AlmaLinux, RockyLinux, Ubuntu, Debian). It includes firewall adjustments to ensure you do not lose SSH access after changing the port.
This guide applies to:
- VPS (Linux)
- Dedicated Servers (Linux)
- Cloud or Bare Metal instances
- Servers using firewalld, ufw, or iptables
2. Description of Content / Step-by-Step Guide
Step 1 — Choose a new SSH port
Recommended safe range: 1024 – 49151. Example: 2222
Step 2 — Open the new port in the firewall
For firewalld (CentOS / AlmaLinux / RockyLinux):
firewall-cmd --permanent --add-port=2222/tcp firewall-cmd --reload
For UFW (Ubuntu / Debian):
ufw allow 2222/tcp ufw reload
Step 3 — Edit SSH configuration
nano /etc/ssh/sshd_config
Find:
#Port 22
Replace with:
Port 2222
Step 4 — Restart SSH service
systemctl restart sshd
Step 5 — Test login using the new port
ssh -p 2222 root@your-server-ip
Step 6 — (Optional) Close port 22 after successful test
Only after confirming the new port works:
firewalld:firewall-cmd --permanent --remove-port=22/tcp firewall-cmd --reloadUFW:
ufw delete allow 22/tcp
3. Common Mistakes
- Changing the SSH port before opening the firewall port (results in lockout).
- Using a port below 1024 without proper system capability.
- Forgetting to reload or restart firewall rules.
- Typing mistakes in sshd_config (syntax errors cause SSH to fail).
- Closing port 22 before verifying connectivity via the new port.
4. Responsibility Breakdown
- Client Responsibility: Manage SSH ports, secure passwords, update firewall rules, maintain OS security.
- iCoreHosting Responsibility: Ensure server is delivered with default secure configuration and access. Assist with server accessibility if port change causes lockout (best-effort basis).
5. FAQ
Q: What is the safest SSH port to use?
A: Anything above 1024. Example: 2222, 2233, 20222.
Q: Will changing the SSH port improve security?
A: Yes, it reduces automated brute-force attacks.
Q: If I get locked out, can iCoreHosting help?
A: Yes, iCoreHosting can assist to restore access (best-effort).
Q: Do I need to reboot the server?
A: No, restarting sshd is sufficient.
6. Summary
To safely change the SSH port, always follow this order:
- Open the new port in the firewall.
- Edit sshd_config and save changes.
- Restart sshd service.
- Test login using the new port.
- Close port 22 after confirming everything works.
This ensures you never lose access to your server.
7. Use Case
- Reduce brute-force attacks on SSH.
- Improve server security without installing extra tools.
- Meet security policies requiring non-standard SSH ports.
- Secure VPS, dedicated server, or cloud instances.
Charges May Apply
Support assistance related to incorrect SSH configuration, firewall misconfiguration, or server lockout may require manual intervention by iCoreHosting’s technical team. Depending on the complexity and support scope, charges may apply. Clients are advised to double-check all configurations before applying changes.
