Secure Your Smart Devices: An SSH IoT Firewall Tutorial

Owen Hettinger 16 Aug 2025

Keeping your smart devices safe and sound is, honestly, a big deal these days. With more and more internet-connected gadgets popping up everywhere, from your home to industrial setups, making sure they're not open to just anyone is super important. This guide will walk you through how to use SSH and a solid firewall to really lock down your IoT devices, giving you peace of mind and better control.

You know, it's almost like having a tiny computer in your hand or in your living room, and just like any computer, it needs protection. We've all seen stories about devices that weren't quite secure enough, leading to some pretty big headaches. So, let's talk about how SSH and a well-set-up firewall can make a huge difference for your internet-connected things, whether it's a small sensor or a larger control unit.

This tutorial is for anyone who wants to make their IoT setup more secure, from folks just starting out with a Raspberry Pi to those managing a small fleet of devices. We'll cover the basics of secure shell (SSH) access, how firewalls work, and some practical steps to put it all together. It's about giving your devices a strong digital front door, and, you know, making sure only the right people have the key.

Why SSH and Firewalls for IoT?
- What is SSH?
- What is a Firewall?
Setting Up SSH on Your IoT Device
Configuring Your IoT Device Firewall
Advanced Security Measures
Troubleshooting Common SSH and Firewall Issues
Frequently Asked Questions (FAQs)
Keeping Your IoT Security Up-to-Date

Why SSH and Firewalls for IoT?

Internet-connected devices, or IoT gadgets, are pretty much everywhere now. They collect data, automate tasks, and make our lives a bit easier, but, you know, they also open up new ways for unwanted visitors to get in. That's why SSH and a good firewall are so important for these little machines.

What is SSH?

SSH, which stands for Secure Shell, is a way to connect to another computer over an unsecured network, but in a very safe manner. It provides a secure channel over an unsecured network by using strong encryption. When you connect, say, to a server via SSH, it's like having a private, encrypted conversation, so no one else can listen in or mess with what you're doing. I recall a time when I was trying to connect to a PostgreSQL database on a server, and while I could get in via SSH from my terminal, setting up a GUI tool like pgAdmin III needed a bit more thought on how the connection was made, often relying on SSH's secure tunnel.

It's what you use to send commands to your IoT device, move files around, or just check on how things are going, all without worrying about someone snooping. Using SSH, every device has a unique digital fingerprint, a key, and your computer remembers the key for each address you connect to. This helps make sure you are talking to the correct device and not some imposter. That's actually pretty clever, when you think about it.

What is a Firewall?

A firewall is like a digital gatekeeper for your device. It decides what network traffic is allowed to come in and go out. Think of it as a security guard checking IDs at a building's entrance. If someone doesn't have the right credentials, or if they're trying to get into an area they shouldn't, the firewall just blocks them. This is super important for IoT devices because many of them might not have a lot of built-in security features, so the firewall becomes their first line of defense. It's about setting clear boundaries, you know?

Setting Up SSH on Your IoT Device

Getting SSH up and running on your IoT device is usually the first step to securing it. Most Linux-based IoT devices, like a Raspberry Pi, come with SSH capabilities, but you might need to turn them on or configure them properly.

Enabling SSH Access

For many IoT boards, especially those running a version of Linux, enabling SSH is quite straightforward. On a Raspberry Pi, for instance, you can do this through the `raspi-config` tool or by simply placing an empty file named `ssh` (no extension) into the boot partition of your SD card before you even start the device up. After that, you can usually connect from your computer using a command like `ssh username@ip_address_of_iot_device`. It's pretty neat how simple that can be.

Sometimes, after installing other services, like GitLab on a local server, I've noticed SSH might stop working correctly, even if it was fine before. This usually means something in the new service's setup changed a network setting or a port. Checking system logs and making sure the SSH service is still running and listening on the right port is often the first thing to do. It's a bit of a detective job, honestly.

Generating and Managing SSH Keys

Using SSH keys for access is much safer than relying on passwords. A key pair has two parts: a private key, which you keep secret on your computer, and a public key, which you put on your IoT device. When you try to connect, your computer uses your private key to prove who you are to the device. The device then checks this against the public key it has. This way, you don't send your password over the network, making it much harder for someone to intercept it.

To create a new SSH key pair, you can use the `ssh-keygen` command in your terminal. It'll ask you where to save the keys, usually in a hidden `.ssh` directory in your home folder. This directory isn't always there by default, but it gets created when you first use SSH to connect to a host. After you make your key, you'll need to copy the public part (often named `id_rsa.pub`) to your IoT device. A common way to do this is using `ssh-copy-id` or manually copying the contents of the public key file into the `~/.ssh/authorized_keys` file on your IoT device. You can copy the file to your clipboard with a command like `pbcopy < ~/.ssh/id_rsa.pub` on macOS, and then just paste it where it needs to go, which is quite handy.

There are times, you know, when you need to use a very specific SSH key pair for a certain connection, perhaps to a proxy server, instead of your usual `id_rsa` key. This is totally possible by telling your SSH client which key to use with the `-i` flag, like `ssh -i /path/to/your/specific_key user@server`. It gives you a lot of flexibility for different access needs.

Securing Your SSH Configuration

Once SSH is working, you should tweak its settings on your IoT device to make it more secure. The main configuration file for the SSH server (sshd) is typically located at `/etc/ssh/sshd_config`. Here are some key changes you might want to make:

Disable Password Authentication: Once you've set up SSH keys, turn off password logins. Find the line `PasswordAuthentication yes` and change it to `PasswordAuthentication no`. This means only people with the correct SSH key can get in.
Disable Root Login: It's generally not a good idea to allow direct login as the 'root' user. Find `PermitRootLogin yes` and change it to `PermitRootLogin no`. Instead, log in as a regular user and then use `sudo` for administrative tasks.
Change the Default Port: SSH usually runs on port 22. Changing this to a different, less common port (like 2222 or 5643) can reduce the amount of automated attack attempts your device sees. We'll talk more about this later.
Limit Users: You can specify which users are allowed to connect via SSH using `AllowUsers` or `DenyUsers` directives. This gives you very precise control over who can get in.

After making any changes to `sshd_config`, you'll need to restart the SSH service for them to take effect. On most Linux systems, you can do this with `sudo systemctl restart ssh` or `sudo service ssh restart`. I remember changing the port for SSH once, using `systemctl edit ssh.socket` to listen on a new port like 5643, and after restarting the socket, we were able to connect without a hitch. It's a good trick, that.

Configuring Your IoT Device Firewall

Even with SSH keys, a firewall adds another layer of security. It's like having a bouncer at the door, only letting in traffic that's specifically approved. This is especially important for IoT devices that might be running other services locally, like an Elastix server or a PostgreSQL database, as mentioned in my notes. You want to make sure only necessary ports are open.

Understanding Basic Firewall Concepts

Firewalls work by setting rules for network traffic. These rules typically involve:

Ports: These are like numbered docks where different services "listen" for connections. SSH usually uses port 22, web servers use 80 or 443, and so on.
Protocols: Such as TCP (Transmission Control Protocol) or UDP (User Datagram Protocol).
IP Addresses: You can allow or block traffic from specific IP addresses or ranges.
Actions: What to do with the traffic – allow it, deny it, or reject it (send a message back saying it was blocked).

The main idea is to block everything by default and then only allow the traffic you specifically need. For an IoT device, this usually means allowing incoming SSH connections (on your chosen port) and perhaps outgoing connections for updates or specific services. Anything else, you just block it. This is, you know, a pretty robust approach.

Setting Up UFW on Linux-Based IoT Devices

UFW, or Uncomplicated Firewall, is a user-friendly way to manage `iptables` rules on Linux systems. It's much simpler to use than `iptables` directly, which is great for many IoT setups. To install it on an Ubuntu-based IoT device, you would run `sudo apt update && sudo apt install ufw`. It's a quick process, honestly.

Here are some common UFW commands to get you started:

Enable UFW: `sudo ufw enable` (This will block all incoming traffic by default, so make sure you allow SSH first!)
Allow SSH: If you're using the default SSH port (22), run `sudo ufw allow ssh`. If you changed your SSH port, say to 5643, you'd use `sudo ufw allow 5643/tcp`. This is a very important step before enabling the firewall, otherwise, you might lock yourself out.
Allow Specific IP for SSH: To allow SSH only from a specific IP address, use `sudo ufw allow from 192.168.1.100 to any port 22`. This is a really good security practice, if you know your connecting IP.
Deny All Other Incoming: UFW denies all incoming traffic by default when enabled, but you can explicitly set it with `sudo ufw default deny incoming`.
Allow All Outgoing: Usually, you want your device to be able to make outgoing connections: `sudo ufw default allow outgoing`.
Check Status: To see your current UFW rules and status, run `sudo ufw status verbose`.

When I had my server running Ubuntu and was trying to connect to it from my Fedora machine, making sure UFW allowed the SSH connection was key. It’s a common scenario, you know, when you’re dealing with different Linux distributions.

Iptables for More Control

`iptables` is the underlying firewall system for Linux, and UFW is just a front-end for it. While UFW is simpler, `iptables` gives you much finer control over your network traffic. For most IoT users, UFW is enough, but for complex setups or very specific needs, `iptables` might be necessary. You could, for instance, set up rules to limit the number of new SSH connections from a single IP address to prevent brute-force attacks. This is a bit more involved, so it's usually for those who really want to dig deep into their network security. It's a powerful tool, though, really.

Advanced Security Measures

Beyond the basics, there are a few more steps you can take to harden your IoT device's security.

Changing the Default SSH Port

As mentioned, SSH typically uses port 22. Automated bots often scan this port looking for easy targets. By changing your SSH port to something else (e.g., 5643, as in my experience, or any other high, unused port number), you immediately reduce the amount of automated "noise" your device receives. You edit the `Port` directive in `/etc/ssh/sshd_config` and then restart the SSH service. Remember to update your firewall rules to allow traffic on the new port and, you know, make sure your client connection commands specify the new port with `-p new_port`.

Implementing Fail2Ban

Fail2Ban is a service that scans log files (like your SSH logs) for repeated failed login attempts. If it sees too many attempts from a specific IP address within a set time, it automatically adds a firewall rule to block that IP for a while. This is a very effective way to stop brute-force attacks. It's like having an automated security guard that reacts to suspicious activity. It's a great layer of defense, honestly, and pretty simple to set up on most Linux systems.

Using SSH for X11 Forwarding

Sometimes, you might want to run a graphical program on your IoT device and display it on your desktop computer. This is where X11 forwarding comes in. SSH can securely tunnel X11 traffic, letting you run GUI applications remotely. I remember wanting to forward X from my Ubuntu machine back to my Fedora workstation so I could run graphical programs remotely. To do this, you usually enable `X11Forwarding yes` in your `sshd_config` file on the IoT device and then connect from your client with `ssh -X user@ip_address`. If you run SSH and your display isn't set, it means X11 forwarding isn't happening. You can confirm it by looking for "requesting X11 forwarding" in the SSH output. It's a rather useful feature for remote management.

Troubleshooting Common SSH and Firewall Issues

Things don't always go perfectly, and you might run into connection problems. Here are some common issues and what to check:

"Connection Refused" or "No route to host": This often means a firewall is blocking the connection, either on your IoT device or somewhere in between. Double-check your firewall rules to make sure the SSH port is open. It could also mean the SSH service isn't running on the device.
"Permission Denied (publickey)": This usually points to an issue with your SSH keys. Make sure your public key is correctly installed in `~/.ssh/authorized_keys` on the IoT device, and that its permissions are set correctly (e.g., `chmod 600 ~/.ssh/authorized_keys`). Also, confirm you're using the correct private key on your client. I've had issues like this after setting up Git on a new computer, where cloning a project failed until I made sure the SSH key was properly added to GitLab.
SSH Not Working After Software Install: As I mentioned, sometimes installing other software (like GitLab or other services) can interfere with SSH. Check if the new software uses the same port, or if it changed network configurations. Restarting the SSH service or checking its status (`sudo systemctl status ssh`) is a good first step.
X11 Forwarding Not Working: If graphical programs aren't displaying, ensure `X11Forwarding yes` is in `sshd_config` on the server, and you're using `ssh -X` from your client. Also, make sure your client has an X server running.

When you're writing a script to automate commands on a remote server via SSH, like I've done with Python, these troubleshooting steps become even more important. You need to be sure the connection is solid before your script tries to do its work. It's all about making sure the path is clear, you know?

Frequently Asked Questions (FAQs)

Here are some common questions people have about securing IoT devices with SSH and firewalls:

Why do I need a firewall on my IoT device if I'm already using SSH keys?

Even with SSH keys, a firewall provides an extra layer of defense. SSH keys protect your SSH connection, but a firewall protects all the other ports and services on your device. It means if there's a vulnerability in another service, the firewall can still block unwanted access to it. It's about reducing the attack surface, really.

How do I secure SSH on a Raspberry Pi?

For a Raspberry Pi, you should enable SSH, disable password authentication, set up SSH key-based login, change the default SSH port, and then configure a firewall like UFW to only allow incoming connections on your chosen SSH port. Installing Fail2Ban is also a very good idea to stop brute-force attempts. It's a pretty standard set of steps, honestly.

What are common SSH connection issues with IoT devices?

Common issues include connection refused (often a firewall or SSH service not running), permission denied (usually SSH key problems or incorrect permissions on key files), and host key warnings (where the client's remembered key for the device doesn't match, possibly indicating a security issue or a re-installation). Checking logs and firewall status is always a good starting point, you know.

Keeping Your IoT Security Up-to-Date

Security isn't a one-time setup; it's an ongoing process. Regularly update your IoT device's operating system and software. This helps patch any newly discovered vulnerabilities. Also, review your firewall rules and SSH configurations periodically to ensure they still meet your needs and security standards. Learn more about secure remote access on our site, and for deeper insights into network protection, you might want to check out this page about network security basics. It's about staying vigilant, always, you know?

Remember, the goal is to make your IoT devices as secure as possible

IoT Firewall

SSH into your IoT Enterprise Gateway - NCD.io

Government Affairs