SSH connectivity failures in Proxmox after a router replacement typically stem from IP address changes, firewall rule misconfigurations, or NAT port forwarding errors. This guide details the diagnostic steps to restore remote access by verifying network interfaces, updating SSH configurations, and ensuring proper routing between the new gateway and your server.
Verifying Network Interface Configuration
When you replace a router, the most common cause of immediate connectivity loss is that the network interface card (NIC) on your Proxmox host retains the old static IP configuration or fails to obtain a new one via DHCP. You must first confirm that the operating system recognizes the new network topology. Log into the Proxmox web interface or use the local console to check the status of your network bridges. Run the commandip addr show to list all active interfaces. Look for your primary bridge, typically named vmbr0. If the IP address displayed matches the old subnet from your previous router, the system has not updated its configuration. In many cases, changing the router also changes the default gateway and DNS servers. You need to edit the network configuration file located at /etc/network/interfaces.
Ensure that the address, netmask, and gateway fields reflect the new environment. If you are using DHCP, verify that the allow-hotplug directive is present and that the service is enabled. After making any changes, restart the networking service using systemctl restart networking or reboot the node entirely to ensure the new settings take effect. Without a valid IP address on the correct subnet, no amount of SSH troubleshooting will succeed.
Checking Firewall Rules and Port Forwarding
Even with a correct IP address, external SSH connections may fail if the new router does not properly forward traffic to the Proxmox host. Most home and small office routers operate behind a NAT (Network Address Translation) firewall. You must log into the admin panel of your new router and locate the Virtual Server or Port Forwarding section. Create a rule that forwards TCP port 22 from the WAN interface to the specific LAN IP address of your Proxmox server. If you recently changed routers, it is highly likely that these rules were lost during the migration. Additionally, check if the new router has an integrated stateful firewall that might be blocking incoming connections by default. Some modern routers include "SPI Firewall" features that require explicit permission for inbound traffic. Ensure that the destination IP in the forwarding rule matches the current static IP assigned to your Proxmox node. For internal network access, verify that the router’s local DHCP server is assigning the same IP to your Proxmox box every time. If the IP changes dynamically, your port forwarding rule will eventually point to the wrong device. Consider setting up a DHCP reservation in the router settings to bind the MAC address of your Proxmox NIC to a fixed IP address. This ensures long-term stability regardless of lease renewals.Validating SSH Service and Host Keys
Sometimes the issue is not network-related but rather a result of SSH host key verification failures. When you connect to a server via SSH, the client stores the server's public key fingerprint. If the underlying IP address changed significantly or if the OS was reinstalled on the same hardware without purging keys, you may encounter a "REMOTE HOST IDENTIFICATION HAS CHANGED" error. This prevents connection for security reasons. To resolve this, you must remove the stale entry from your local machine's~/.ssh/known_hosts file. On Linux or macOS, use ssh-keygen -R [your-proxmox-ip]. On Windows using PowerShell or Command Prompt, you can manually edit the file or use tools like PuTTY to clear the cache. Once cleared, attempt to reconnect. The client will prompt you to accept the new host key, which should match the current identity of your Proxmox node.
Inside Proxmox, ensure the SSH daemon is running and listening on the correct interface. Check the status with systemctl status sshd. Review the configuration file at /etc/ssh/sshd_config to ensure Port 22 is uncommented and PermitRootLogin is set according to your security policy. While disabling root login is recommended for production environments, testing with root access can help isolate authentication issues from network issues. Remember to restart the SSH service after editing the config file.
DNS and Static Route Considerations
If you access your Proxmox server via a domain name rather than an IP address, changing routers often requires updating your DNS records. Your ISP may have changed your public IP address, meaning your dynamic DNS provider or static A record needs to point to the new address. Verify your public IP using a service likecurl ifconfig.me on the Proxmox node and compare it with your DNS provider's records.
For advanced setups involving multiple subnets or VLANs, ensure that static routes are correctly configured on both the router and the Proxmox host. If your Proxmox server resides on a different VLAN than the management network, the router must know how to route packets back to that segment. Incorrect routing tables can lead to asymmetric routing, where requests reach the server but responses cannot return, causing SSH timeouts.
Troubleshooting SSH Connection Issues from External IP Address provides further insight into handling NAT traversal problems that often accompany router swaps. Additionally, reviewing Cannot ssh into self hosted server from public IP can help identify broader connectivity blockers unrelated to the immediate hardware change.
Frequently Asked Questions
Why does my SSH connection time out immediately?
This usually indicates a network-level blockage, such as missing port forwarding rules on the new router or an incorrect IP address configuration on the Proxmox host. Verify that your firewall allows inbound TCP traffic on port 22 and that the NAT rule points to the correct internal IP.
Can I use a different port for SSH to avoid detection?
Yes, you can change the listening port in /etc/ssh/sshd_config by modifying the Port directive. However, you must also update the corresponding port forwarding rule on your router to forward the new external port to the internal SSH port on Proxmox.
What if I forget the root password after the router change?
A router change does not alter local credentials, so your password remains the same. If you cannot connect, use the physical console or IPMI/iDRAC access to reset the password locally via the Proxmox shell or recovery mode.
Does changing routers affect ZFS pool integrity?
No, changing the network router has no impact on storage subsystems like ZFS. Data integrity depends on disk health and RAID configuration, not on network gateway changes.
How do I check if my new router supports IPv6?
Log into your router's admin panel and look for WAN settings or IPv6 configuration tabs. If supported, enable it and configure Proxmox to obtain an IPv6 address via SLAAC or DHCPv6, then update your DNS records accordingly.