Every Lightsail machine is born with port 22 (SSH) open to the whole world. As soon as it has a public IP, automated login attempts start arriving from half the planet: thousands a day. With a strong SSH key they won't get in, but they fill the logs, consume resources and any future flaw in the SSH service is left exposed. The right solution is simple: allow port 22 only from the IP you connect from.
Lightsail has its own firewall, per machine, managed from the console without touching anything inside the server. That makes it very convenient, and also very easy to lock yourself out if you get it wrong, so follow the steps in order.
Before you start: what each thing means
- Firewall
- The doorman of your machine: a list of which doors (ports) are open and for whom. In Lightsail it is managed from the web console, without logging into the machine.
- Port 22 and SSH
- SSH is the way a technician logs into the machine to administer it from a terminal. It uses "door" number 22. If it is open to everyone, everyone will try to get in.
- Public IP
- The numeric address your connection uses to reach the internet. You can see it by searching "what is my IP". It is different from the internal address of your computer at home or in the office.
- Dynamic or static IP
- Dynamic: your provider changes your address every so often (the norm at home). Static: always the same (common for businesses, sometimes for a fee).
- CIDR (/32, /24)
- A shorthand way of writing a range of addresses. "/32" is a single address; "/24" is 256 consecutive ones. If you only want your IP, you don't need to write anything: the address alone is enough.
- IPv4 and IPv6
- Two types of internet address, the classic one (four numbers with dots) and the new one (longer, with letters and colons). The machine can have both, and each has its own firewall.
Step by step
Find out your public IP
From the computer you connect with, search "what is my IP" in the browser or ask your router. Write down the IPv4 address, four numbers separated by dots. If you work from the office and from home, you will need both.
Important: if your connection has a dynamic IP (most home connections do), it will change every so often and you will have to update the rule. We cover that at the end.
Open the machine's firewall
In the Lightsail console, Instances tab, click your machine and then the Networking tab. Below the public IP is the IPv4 Firewall block with the current rules. You will see the SSH one with "Any IP address" as the source.
Edit the SSH rule and restrict the source
Click the pencil on the SSH, TCP 22 rule. Tick the Restrict to IP address box and enter your IP from step 1. You can add several addresses to the same rule, or create one rule for each place you connect from. If you want a range, use CIDR notation, for example
203.0.113.0/24.Leave the Allow Lightsail browser SSH option ticked if it appears: that way, even if your IP changes, you will always be able to get in with the web terminal of the Lightsail console, which comes from AWS's own addresses. It is your safety net.
Save and test without closing the current session
Save the rule. The change is immediate. Before taking anything for granted, open a new SSH session from your computer and check that you get in. If you already had a session open, don't close it until you confirm the new one works: established connections are not cut off, but new ones are filtered.
Check the IPv6 firewall too
If the machine has IPv6 enabled, a little further down there is a separate IPv6 Firewall block, with its own SSH rule open to everyone. If you don't use IPv6 to connect, delete that rule or restrict it to your IPv6 address. It is the most common oversight: the IPv4 door gets closed and the IPv6 one is left wide open.
Decide what to do when your IP changes
With a dynamic IP, one day you won't get in. You have three reasonable options: get in through the Lightsail browser terminal and change nothing (fine for an emergency); update the rule with your new IP from the console, which takes a minute; or ask your provider for a static IP, which is usually available on business connections.
What can go wrong
I have locked myself out of SSH
Don't panic: the Lightsail firewall is changed from the web console, not from inside the machine. Go to Lightsail, Networking tab, and correct the IP in the rule. If you need to get in right now, use the Lightsail browser terminal ("Connect using SSH" button on the machine), which doesn't go through your IP.
Still can't get in even though the IP is correct
Check whether the machine also has an internal firewall (ufw on Ubuntu, firewalld on Amazon Linux) and that it allows 22. Both firewalls, Lightsail's and the system's, have to let you through. And check that you are using the IP of the computer you connect from, not that of a VPN or another office.
I entered the IP of my local network
Addresses starting with 192.168, 10. or 172.16 to 172.31 belong to your internal network and are no use: the Lightsail firewall sees your public IP, the one your provider gives you. Go back to step 1.
A colleague needs to get in from somewhere else
Add their IP as another entry in the same rule instead of opening it to the whole world again. And if the list grows, it is time to think about a VPN or a bastion host: a single entry IP that you manage.
In Simplio
In Simplio the firewall of every Lightsail machine is an editable list: you add the port, choose "Only my IP" (Simplio already knows yours) and save, with two-factor confirmation for sensitive changes. Each person on your team also sees only the machines you have assigned to them, and every change is kept in the activity log with who, when and from where.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Closing port 22 to your IP | Find your IP, Lightsail console, Networking tab, edit rule, repeat for IPv6: 5 steps, 5 minutes per machine | "Only my IP" rule (Simplio already knows it): 1 click per machine |
| When your IP changes | Back to the console to edit the rule | Same click; or get in through the Simplio terminal without touching anything |
| Knowing who opened what | CloudTrail, if you go looking | Every change in the activity log with user, date and IP |