I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public.

I closed Port 22 on the VCN and left Port 22 open on the server. But no one will access it 'cause I am the only one that can access it via Tailscale.

ubuntu@instance-20220422-2359:~$ sudo firewall-cmd --list-all
  target: default
  icmp-block-inversion: no
  services: dhcpv6-client ssh
  ports: 80/tcp 443/tcp
  masquerade: no
  rich rules:
        rule family="ipv4" source address="" reject
        rule family="ipv4" source address="" reject

Today, I received a report from CrowdSec that my server was experiencing ssh-brute force from China IP addresses.

enter image description here

How did it happen? I am using a VPN to access those servers and yet they manage to brute force a closed Port?

  • You can render those down to a trivial threat using something like fail2ban. I also strongly recommend disabling root access (use a real account and sudo). Ideally, also restrict logins to using keys.
    – Adam Katz
    Commented Apr 25, 2022 at 17:46
  • @AdamKatz how does disabling root access help? If they already got into the Pi, wouldn't they have the password to authenticate for any sudo commands?
    – Macuser
    Commented Jun 28, 2023 at 16:26
  • @Macuser – In addition to having logs of what was done as sudo (and who did it), barring direct root login requires attackers to guess your username. If you look at your logs for failed SSH logins, you'll notice that root is the most common user they attempt to authenticate as. Then again, if you're using a generic username like ubuntu, you're not as protected as you would be with something personal, like macuser or hanson.
    – Adam Katz
    Commented Jul 10, 2023 at 15:44

1 Answer 1


I don't think your configuration is working as you think it should. It is always strongly advised to test your setup from a non-whitelisted IP address.

Your output says:

services: dhcpv6-client ssh

That implies SSH service is effectively exposed, and port 22/TCP is allowed on the public zone, that is for everyone. This is in addition to your port rules or rich rules. But you don't want that.

My suggestion is to remove the SSH service from the public zone, and instead you can add a few whitelisted IP addresses (your VPN) to the trusted zone. This will make the SSH service available but also other running services if present.

Reference: Open a Port or Service

  • 1
    Excellent answer, +1. OP, you might want to use a tool like portchecker.co to test if port 22 is really closed to a non-whitelisted IP.
    – mti2935
    Commented Apr 24, 2022 at 20:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .