Ubuntu Server 22.04 becomes unreachable via SSH after static IP configuration when Netplan generates invalid YAML syntax, firewall rules block port 22, or the network interface fails to activate during boot. Verify connectivity by logging in locally or via console, then inspect netplan status and ufw rules to identify the specific misconfiguration preventing remote access.
Verifying Local Connectivity and Console Access
Before diving into complex network configurations, you must establish a baseline for troubleshooting. If the server is hosted on a cloud provider like AWS, Azure, or DigitalOcean, use the web-based console or VNC access provided by the vendor. This bypasses all network layer issues and allows you to interact with the operating system directly. If you have physical access to the machine, connect a monitor and keyboard to log in locally. This step is critical because it confirms whether the operating system itself is running correctly and if the SSH daemon is active, even if it is not responding to external requests.
Once logged in, check the status of the SSH service by running sudo systemctl status ssh. Ensure that the service is enabled and currently active. If the service is inactive, start it immediately using sudo systemctl enable --now ssh. Additionally, verify that the SSH daemon is listening on the correct port by executing sudo ss -tlnp | grep :22. If no output appears, the SSH service may be configured to listen on a non-standard port or has failed to bind to the network interface.
Validating Netplan Configuration Syntax
The most common cause of SSH failure after changing IP settings in Ubuntu 22.04 is an error in the Netplan configuration files. These files are located in the /etc/netplan/ directory and typically end with a .yaml extension. YAML is extremely sensitive to indentation; a single space difference can cause the entire configuration to fail silently or revert to DHCP. To diagnose this, run sudo netplan try. This command applies your changes temporarily and reverts them if any errors are detected within a timeout period, usually sixty seconds. It provides immediate feedback on syntax errors without permanently breaking your network connection.
If netplan try reports errors, carefully review the indentation in your configuration file. Ensure that keys like addresses, gateway4 (or routes in newer versions), and nameservers are aligned correctly under the appropriate interface name. After correcting the syntax, apply the changes permanently using sudo netplan apply. You can verify the new IP address by running ip addr show to ensure the static IP is assigned to the correct interface. If the interface remains down, check the system logs with journalctl -u NetworkManager or journalctl -u systemd-networkd for detailed error messages regarding interface activation.
Checking Firewall Rules and Security Groups
Even with a correct IP address and active SSH service, external connections may be blocked by firewall software. Ubuntu uses Uncomplicated Firewall (UFW) by default. Check its status by running sudo ufw status verbose. Look for a rule allowing traffic on port 22 from any source or specifically from your trusted IP range. If UFW is inactive, the issue might lie with the cloud provider’s security groups or network ACLs. Log in to your hosting provider’s dashboard and ensure that inbound traffic on TCP port 22 is allowed for your instance’s private or public IP address.
If UFW is active but missing the SSH rule, add it using sudo ufw allow ssh or sudo ufw allow 22/tcp. Reload the firewall rules with sudo ufw reload to apply the changes. In some cases, previous rules may have been deleted accidentally during troubleshooting. Review the full list of rules to ensure there are no conflicting deny statements that take precedence over allow rules. Remember that firewall misconfigurations are distinct from Netplan errors; one handles packet filtering while the other handles IP assignment.
Investigating SSH Daemon Configuration
If the network and firewall are functioning correctly, the SSH daemon itself might be rejecting connections. Edit the main configuration file at /etc/ssh/sshd_config using a text editor like nano or vim. Ensure that PermitRootLogin is set to prohibit-password or no depending on your security requirements, rather than leaving it unset or incorrectly formatted. Also, verify that PubkeyAuthentication yes is enabled if you are using key-based authentication. After making any changes, restart the SSH service with sudo systemctl restart ssh.
Check the SSH logs for specific rejection reasons by running sudo tail -f /var/log/auth.log while attempting to connect from another machine. Look for entries indicating "Connection closed by authenticating user" or "Failed password." These logs provide precise information about why the connection is being dropped. If you recently changed the SSH port, ensure that both the sshd_config file and the firewall rules reflect the new port number. For more details on permission issues, see SSH Connection Permission Denied on New Ubuntu 22.04 LTS Server.
Testing Connectivity and Final Verification
After addressing potential causes, test the connection from a different machine on the same network using ssh username@server_ip. Use the -v flag for verbose output to see exactly where the connection fails, whether at the DNS resolution stage, TCP handshake, or SSH protocol negotiation. If the connection succeeds, verify that you can perform basic operations like listing directories and editing files. Finally, reboot the server to ensure that the static IP configuration persists across restarts and that SSH starts automatically upon boot. This final step confirms that the solution is robust and not dependent on manual service starts.
Frequently Asked Questions
What if netplan apply fails with a syntax error?
Always run sudo netplan try before applying changes permanently, as it reverts automatically on failure. Check your YAML file for incorrect indentation, as spaces must be consistent throughout the document. Use online YAML validators to double-check the structure before applying it to the system.
How do I reset SSH if I lock myself out completely?
You must use the cloud provider’s console or physical access to reset permissions. Edit /etc/ssh/sshd_config locally to disable password authentication or change the port temporarily. Restart the SSH service and reconnect using the adjusted settings to regain remote access.
Why does my server lose its static IP after reboot?
This usually indicates that Netplan did not save the configuration correctly or the wrong interface name was specified. Verify the interface name with ip link and ensure it matches the name in your Netplan YAML file. Check journal logs for network service failures during boot to identify persistent configuration errors.
Can I use a different port for SSH to avoid conflicts?
Yes, you can change the port in /etc/ssh/sshd_config by modifying the Port directive. Remember to update your firewall rules to allow traffic on the new port and adjust your SSH client commands to specify the port explicitly. This is useful for reducing automated scan attacks but requires careful firewall management.
What should I do if UFW blocks all incoming traffic?
Run sudo ufw default allow incoming to temporarily open all ports for testing, though this is insecure. Identify the specific rule blocking SSH with sudo ufw status numbered and delete it using sudo ufw delete [number]. Re-enable strict default policies after adding the correct allow rule for SSH.