When you provision an Ubuntu instance on Oracle Cloud, you'll notice something different from standard Ubuntu installations: the system uses iptables instead of ufw for firewall management. This distinction is crucial when you want to change your SSH port—simply editing /etc/ssh/sshd_config won't be enough. You need to configure both the SSH daemon and the firewall rules, plus update Oracle Cloud's network security settings.
This guide walks you through the complete process of safely changing your SSH port on Oracle Cloud.
Why This Matters
SSH typically runs on port 22, which is a well-known target for brute-force attacks and automated scanning. Changing it to an uncommon port significantly reduces unwanted connection attempts and improves security through obscurity. However, if you skip the firewall configuration, your new SSH port simply won't accept connections—leaving you locked out of your instance.
Step 1: Modify the SSH Configuration File
Start by editing the SSH daemon configuration:
sudo nano /etc/ssh/sshd_config
Locate the line that specifies the port. It may be commented out with a # symbol:
# Port 22
Uncomment it and change it to your desired port (we'll use 2222 in this example):
Port 2222
Save the file by pressing Ctrl + X, then Y, then Enter.
Step 2: Update iptables Firewall Rules
This is the critical step that many people miss. You need to add a new iptables rule to allow traffic on your new SSH port.
First, check your current iptables rules and their line numbers:
sudo iptables -L INPUT --line-numbers
This command displays output similar to:
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
2 ACCEPT icmp -- anywhere anywhere
3 ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
4 ACCEPT tcp -- anywhere anywhere tcp dpt:http
5 ACCEPT tcp -- anywhere anywhere tcp dpt:https
6 REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
The key insight: you must insert your new SSH rule above the reject-all rule (line 6 in this example). Insert the rule at position 6:
sudo iptables -I INPUT 6 -p tcp --dport 2222 -m state --state NEW -j ACCEPT
Breaking down this command:
-I INPUT 6 — Insert at position 6 in the INPUT chain-p tcp — Protocol is TCP--dport 2222 — Destination port is 2222-m state --state NEW — Match new connections-j ACCEPT — Accept the connection
Step 3: Persist iptables Configuration
By default, iptables rules are lost when you reboot. Save them using netfilter-persistent:
sudo netfilter-persistent save
This command writes your iptables rules to disk so they survive system restarts.
Step 4: Restart the SSH Service
Apply your configuration changes:
sudo systemctl daemon-reload
sudo systemctl restart ssh
Verify the service is running:
sudo systemctl status ssh
Step 5: Update Oracle Cloud Network Security Rules
SSH won't work until you update Oracle Cloud's security lists. Navigate through the web console:
- Go to Networking → Virtual Cloud Networks
- Select your VCN
- Click Security Lists
- Open the Default Security List
- Click Add Ingress Rules
Fill in the following fields:
| Field |
Value |
| Source Type |
CIDR |
| Source CIDR |
0.0.0.0/0 |
| IP Protocol |
TCP |
| Source Port Range |
All |
| Destination Port Range |
2222 |
Click Save. Oracle Cloud will apply the rule within seconds.
Testing Your Connection
Once all changes are in place, test the new SSH connection from your local machine:
ssh -i ssh-xxx.key -p 2222 ubuntu@your-public-ip
Replace ssh-xxx.key with your private key path and your-public-ip with your instance's public IP address.
If the connection succeeds, you've successfully changed your SSH port. If it hangs or times out, double-check:
- iptables rule was inserted (check with
sudo iptables -L INPUT --line-numbers)
- Oracle Cloud security list rule was created
- SSH daemon restarted successfully
Cleaning Up: Removing the Old Port 22 Rule
Once you've confirmed SSH works on the new port, remove the old rule for port 22 to reduce attack surface.
First, identify the line number of the old SSH rule:
sudo iptables -L INPUT --line-numbers
Delete it using the -D (delete) flag:
sudo iptables -D INPUT 3
Replace 3 with the actual line number from your output.
Save the updated rules:
sudo netfilter-persistent save
Also remove the old port 22 ingress rule from Oracle Cloud's security list:
- Return to Networking → Virtual Cloud Networks → Security Lists
- Find the rule for port 22 in the ingress rules list
- Click the X icon to delete it
Key Takeaways
- Oracle Cloud uses iptables, not ufw — Configure the firewall accordingly
- Rule position matters — Insert above the reject-all rule to avoid blocking yourself
- Three layers of configuration — SSH config, iptables, and Oracle Cloud security rules must all be updated
- Test before cleaning up — Confirm the new port works before removing the old rule
- Persist your changes — Use
netfilter-persistent save to survive reboots
Changing SSH ports is a quick security hardening measure that's well worth the few minutes it takes to configure properly.
Reference
