Can’t Reach Your VPS From Outside? Fix Firewall & Ports

If you can’t reach your VPS from outside, the cause is almost always a firewall rule blocking the port, a service listening only on localhost, or the cloud provider’s security group not allowing inbound traffic. This article walks you through diagnosing each layer and applying the fix, from checking the service status to adjusting iptables, firewalld, UFW, and cloud security groups.

First, Confirm the Service Is Running and Listening

Before touching the firewall, verify that the application itself is up and bound to the correct interface. A service that crashed or is listening only on 127.0.0.1 will be unreachable from outside no matter what the firewall allows.

1. SSH into your VPS (if you can’t, use the provider’s web console).
2. Check the service status. For systemd systems: systemctl status <service-name> (e.g., systemctl status nginx).
3. See what ports are open and which address they bind to: sudo ss -tlnp. Look for the port you need. If it shows 127.0.0.1:8080 instead of 0.0.0.0:8080 or :::8080, the service is only listening locally.

If the service is bound to localhost, edit its config file to listen on 0.0.0.0 or the specific public IP, then restart it. For example, in Nginx change listen 127.0.0.1:80; to listen 80;; in MySQL/MariaDB, set bind-address = 0.0.0.0 in my.cnf. For Docker, ensure you publish the port with -p 0.0.0.0:8080:8080 or -p 8080:8080 (which binds to all interfaces by default).

Check the Cloud Provider’s Security Group / Firewall

Most VPS providers (AWS, DigitalOcean, Linode, Vultr, etc.) have an external firewall or security group that sits in front of your server. Even if your OS firewall is wide open, the provider’s firewall can block traffic.

• Log into your provider’s control panel and find the networking or firewall section for your VPS.
• Look for an inbound rule for the port you need (e.g., TCP 8080). If it’s missing, add it.
• Some providers also have a separate cloud firewall that you must attach to the server. Make sure it’s attached and has the right rules.

If you recently created the VPS, the default rules often only allow SSH (port 22). You must explicitly allow other ports. After adding the rule, wait a few seconds and test again.

Inspect and Adjust the OS Firewall

On the VPS itself, the firewall is usually one of three tools: UFW (Ubuntu/Debian), firewalld (CentOS/RHEL/Fedora), or iptables directly. Identify which one is active.

UFW (Uncomplicated Firewall)

1. Check status: sudo ufw status verbose
2. If inactive, you can enable it, but be careful to allow SSH first: sudo ufw allow 22/tcp then sudo ufw enable.
3. Allow your port: sudo ufw allow 8080/tcp
4. Reload if needed: sudo ufw reload

firewalld

1. Check status: sudo systemctl status firewalld and sudo firewall-cmd --state
2. List current rules: sudo firewall-cmd --list-all
3. Add a permanent rule: sudo firewall-cmd --permanent --add-port=8080/tcp
4. Reload: sudo firewall-cmd --reload

iptables

If you use raw iptables or a script that sets rules, check: sudo iptables -L -n. Look for a DROP or REJECT rule that might be catching your port. To allow a port temporarily: sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT. Remember that iptables rules are not persistent by default; use iptables-save or a tool like iptables-persistent to make them survive a reboot.

Test Connectivity from Outside

After adjusting rules, test from your local machine (not from the VPS itself). Use a tool that checks the port, not just ping (ICMP may be blocked separately).

• Telnet: telnet your-vps-ip 8080 – if it connects, the port is open.
• nc (netcat): nc -zv your-vps-ip 8080
• curl (for HTTP): curl -v http://your-vps-ip:8080
• Online port checkers – many websites offer a free port check tool; they test from outside your network.

If the test fails, re-check each layer. A common mistake is testing from the VPS itself using localhost – that bypasses the network path and can give a false positive. Always test from an external device or service.

Common Pitfalls and Misconceptions

Several issues are frequently mistaken for firewall problems.

• Ping works but port doesn’t – ICMP and TCP are separate; a firewall can allow ping while blocking the port.
• Service restarts after firewall change – If you restart the service, it may re-bind to a different address or fail to start. Always check ss -tlnp again.
• IPv6 vs IPv4 – If your VPS has an IPv6 address and you’re testing over IPv4, the firewall rules might differ. Ensure your rules apply to both (e.g., in UFW, ufw allow 8080/tcp covers both, but some iptables setups need separate rules for IPv6 with ip6tables).
• Provider NAT or proxy – Some providers put your VPS behind a NAT; you may need to set up port forwarding in the control panel.
• SELinux – On CentOS/RHEL, SELinux can block ports even if the firewall allows them. Check with sudo getenforce; if Enforcing, you may need to add a policy or set sudo setsebool -P httpd_can_network_connect 1 for web services.

When All Else Fails: Reboot and Recheck

If you’ve verified the service is listening, the OS firewall allows the port, and the provider’s firewall allows it, but you still can’t connect, try a full reboot of the VPS. Sometimes a service fails to start after a config change, or a firewall rule isn’t applied correctly until restart. After reboot, re-check the service status and listening ports.

Also, check if the VPS has multiple network interfaces – the public IP might be on a separate interface (e.g., eth0 vs eth1). Use ip addr to see all addresses and make sure the service is bound to the one that faces the internet.

Frequently Asked Questions

Why can I SSH but not access my web server?

SSH is usually allowed by default in the firewall, but port 80/443 is not. Check both the cloud security group and the OS firewall for rules allowing HTTP/HTTPS traffic. Also ensure your web server is running and listening on 0.0.0.0:80.

How do I open a port on UFW?

Use sudo ufw allow <port>/tcp. For example, sudo ufw allow 8080/tcp. Then verify with sudo ufw status. If you need a range, use sudo ufw allow 1000:2000/tcp.

What is the difference between a cloud firewall and the OS firewall?

The cloud firewall (security group) is managed by your VPS provider and filters traffic before it reaches your server’s network interface. The OS firewall (UFW, firewalld, iptables) runs on the server itself. Both must allow the traffic – a block in either one will prevent connection.

Why does my port show open on the server but not from outside?

This usually means the service is listening on 127.0.0.1 only, or the cloud provider’s firewall is blocking the port. Check ss -tlnp to see the bind address, and review the security group rules in your provider’s panel.

How do I make iptables rules persistent?

On Debian/Ubuntu, install iptables-persistent and save with sudo netfilter-persistent save. On RHEL/CentOS, use sudo service iptables save or sudo iptables-save > /etc/sysconfig/iptables. Alternatively, use a tool like UFW or firewalld that handles persistence automatically.

Can I test a port from my VPS to itself?

You can test locally with curl localhost:8080 or nc -vz localhost 8080, but that only proves the service is up. To test external reachability, you must connect from a different machine or use an online port checker.

Related

• Can’t Access WordPress Admin After Enabling HTTPS? Fix
• WordPress Migration Problems and Fixes
• Duplicate a Post and Publish the Edited Copy?