Restrict SSH

Use the Hostinger firewall to accept SSH from one fixed IP address and drop all other incoming traffic.

SSH keys decide who can log in. A firewall decides who can reach the login at all. With a fixed public IP address from a VPN or your internet provider, you can allow SSH from that one address and drop everything else.

Skip this page if your IP address changes often. A rule for an old address locks you out until you update it in hPanel.

Before you start, confirm that SSH works and that you can open the hPanel web console. The web console does not depend on this firewall, so it is your way back in.

Find your public IP

Connect to the VPN you plan to use, then check your address.

curl -4 https://ifconfig.me
# 203.0.113.25

On Windows, type curl.exe. In Windows PowerShell, curl alone runs a different command.

Use your own address. It is the public address of your laptop or VPN, not the VPS address and not a local 192.168.x.x address.

Create the firewall

In hPanel, open your VPS, then Security, then Firewall. Click Add firewall and name it, for example ssh-dedicated-ip. A new firewall starts inactive.

Add the SSH rule

Open the firewall's actions menu and choose Edit. It starts with one rule that drops all traffic. Add this rule:

Field	Value
Action	Accept
Protocol	TCP
Port	22
Source	Custom
Source details	`<YOUR_IPV4>/32`

/32 means exactly one IPv4 address. Keep the drop rule. Check that no other rule accepts port 22 from anywhere.

Activate it

Go back to the firewall list, turn the firewall on, and confirm Activate for your VPS. The status changes to Active. After any later edit, click Synchronize and give it up to two minutes.

Check

Open a new SSH connection. A session that was already open is not proof, because Hostinger keeps existing connections alive when rules change.

ssh agent-cloud
whoami
# developer

The rule drops everything that is not SSH from your address. That includes public web ports and IPv6 SSH, so always connect to the IPv4 address. Editors and file transfer over SSH still work, because they use the same port 22 connection.

If your IP changes

Connect to the right VPN location first. If the address really changed, open the firewall in hPanel, replace the source with the new address, and click Synchronize. Test a new connection before you close the web console.

Resetting the firewall inside Ubuntu does not touch this rule, because Hostinger applies it outside the server. Do not open port 22 to everyone as a quick fix.