ufw and firewalld: open and close ports

Debian and Ubuntu ship ufw (Uncomplicated Firewall); RHEL, Rocky Linux, AlmaLinux and Fedora ship firewalld. Both are front ends to the kernel packet filter (nftables), and both follow the same model: everything incoming is blocked unless you allow it, everything outgoing is allowed.

Careful: enabling a firewall on a remote server with SSH not allowed disconnects you for good. Allow SSH first, keep your current SSH session open, and test the new rules from a second terminal before you close the first one. If the second login fails, you still have the first session to undo the change.

ufw (Debian, Ubuntu)

sudo ufw status verbose                 # inactive on a fresh install
sudo ufw allow OpenSSH                  # same as: sudo ufw allow 22/tcp
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable                         # asks for confirmation, then active at every boot

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 51820/udp                # WireGuard
sudo ufw allow from 192.0.2.0/24 to any port 5432 proto tcp   # PostgreSQL only from one network
sudo ufw limit 22/tcp                   # rate-limit: block an IP after 6 connections in 30 seconds

Application names such as OpenSSH or Nginx Full come from profiles that packages install under /etc/ufw/applications.d/; list them with sudo ufw app list.

To close a port, either repeat the rule with delete in front or delete by number:

sudo ufw delete allow 80/tcp
sudo ufw status numbered
sudo ufw delete 3                       # the rule shown as [ 3]

sudo ufw disable                        # stop filtering (rules are kept)
sudo ufw reset                          # remove every rule and disable

Docker publishes ports by writing its own nftables rules, which bypass ufw. A container started with -p 8080:8080 is reachable from outside even if ufw does not allow 8080. Bind published ports to localhost (-p 127.0.0.1:8080:8080) and put a reverse proxy in front if that is not what you want.

firewalld (RHEL, Rocky, Alma, Fedora)

firewalld groups interfaces into zones; on a server everything is normally in the public zone. A change applies either to the runtime (now, lost at reload or reboot) or, with --permanent, to the saved configuration (after --reload). The safe pattern is to change the runtime first, test, then save.

sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --list-all                          # rules of the default zone

sudo firewall-cmd --add-service=http                   # runtime only
sudo firewall-cmd --add-service=https
sudo firewall-cmd --add-port=8080/tcp
sudo firewall-cmd --add-port=51820/udp
# test from another machine, then make it permanent:
sudo firewall-cmd --runtime-to-permanent

# or do both at once
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

The SSH service is allowed in the public zone by default, so a fresh firewalld installation does not lock you out. sudo firewall-cmd --get-services lists the service names it knows (http, https, postgresql, wireguard and many more).

To allow a port only from one source network, use a rich rule:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.0.2.0/24" port port="5432" protocol="tcp" accept'
sudo firewall-cmd --reload

Closing is the mirror image:

sudo firewall-cmd --permanent --remove-port=8080/tcp
sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

If you make a runtime-only change you are unsure about, sudo firewall-cmd --reload throws it away and goes back to the saved configuration. That is a useful safety net: open a port at runtime, test, and reload if anything went wrong.

Verify from the outside

nc -zv server.example.com 8080        # from your laptop
sudo ss -ltnp                          # on the server: is anything listening at all?

A port that is open in the firewall but has no listener still gives Connection refused. Opening a port and starting the service are two separate steps.

Official documentation

• ufw(8)
• firewall-cmd(1)
• Docker: packet filtering and firewalls