On Tue, Sep 8, 2026 at 7:14 AM dan <[email protected]> wrote: > I just started to wonder if in front of a sudden update of an hosting > firewall (such as vultr, digital ocean, hetzner, etc) or a refreshed public > ip address there is any danger that any active ssh connection can get > closed down. > > Is generally speaking too complex for these basic firewalls close down > active connections on the fly or I need to worry seriously about my remote > backups ? >
SSH runs over TCP, and TCP connections are defined by the tuple <source-ip,source-port,dest-ip,dest-port>, where source represents the computer that initiated the TCP session and dest represents the system that accepted it. If either IP address changes, IP packets with those changed addresses will be discarded as they don't match the established tuple. The effect on SSH will be that your session freezes and eventually times out. If you reconnect (using the new IP address(es)) SSH will establish a new session (with a new tuple) and the new session will work fine. SSH is an encrypted protocol so it's not effectively possible for an intermediate router or gateway to inject a graceful shutdown request into the protocol traffic. In general it's too complex to do this even for non-encrypted protocols. It's easier to simply drop the connection and let the endpoints sort it out. Note that large providers will typically have redundancy in their firewall setups so that they perform updates without disrupting normal traffic so this is something you won't normally need to worry about. Using an unreliable network, I recommend either performing backups frequently enough that you can miss one without issue, or checking return codes and retrying on failure. It's unlikely that a backup will fail in such a way that the client thinks it succeeded. -ken
