Open ports with firewalld and ufw

Both tools manage the same kernel packet filter (nftables or iptables underneath) but think about it differently. firewalld groups rules into zones and separates the running (runtime) config from the saved (permanent) config. ufw, the “uncomplicated firewall” on Ubuntu, is a simple list of allow and deny rules. Use the one your distribution ships and do not run both.

Warning: when you work over SSH, make sure SSH stays allowed before you enable a firewall or change its default policy. Keep a second session or console access open until you have tested a new login.

firewalld (RHEL, Rocky, AlmaLinux)

firewalld is installed and running by default. See what is allowed now:

sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones      # which zone each interface is in
sudo firewall-cmd --list-all              # services and ports of the default zone

On a default install the active zone is usually public and already allows ssh. Open a web server:

1. Add the services to the permanent config: sudo firewall-cmd --permanent --add-service=http --add-service=https
2. Load the permanent config: sudo firewall-cmd --reload
3. Check: sudo firewall-cmd --list-services

Without --permanent, a change applies immediately but is lost on reload or reboot. That is useful for testing: change at runtime, test, then save the working state with sudo firewall-cmd --runtime-to-permanent. Note that --reload throws away runtime-only changes.

# a port with no predefined service
sudo firewall-cmd --permanent --add-port=8080/tcp

# remove something again
sudo firewall-cmd --permanent --remove-service=http

# list the predefined service names
sudo firewall-cmd --get-services

sudo firewall-cmd --reload

To allow a port only from one network, use a rich rule:

sudo firewall-cmd --permanent --zone=public \
  --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port port="5432" protocol="tcp" accept'
sudo firewall-cmd --reload

ufw (Ubuntu)

ufw is usually installed on Ubuntu but not enabled. Check, add the SSH rule first, then enable:

sudo ufw status verbose
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

ufw enable asks for confirmation because it may disrupt existing SSH connections. With the SSH rule in place, answer yes, then test a new login from another terminal.

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow from 10.0.0.0/24 to any port 5432 proto tcp
sudo ufw limit 22/tcp        # deny an address after 6+ connections in 30 seconds

sudo ufw status numbered
sudo ufw delete 3            # delete rule number 3 from the numbered list
sudo ufw delete allow 80/tcp # or delete by repeating the rule

ufw app list shows application profiles installed by packages; you can allow one by name with sudo ufw allow "Name".

Side by side

• Show rules: firewall-cmd --list-all / ufw status verbose
• Open a port: firewall-cmd --permanent --add-port=8080/tcp + --reload / ufw allow 8080/tcp
• Allow from one network: rich rule / ufw allow from 10.0.0.0/24 to any port 5432 proto tcp
• Close it again: --remove-port + --reload / ufw delete allow 8080/tcp

Remember

• A port only answers if a program listens on it. Check with sudo ss -tlnp.
• Cloud servers usually have a provider firewall (security groups) in front of the server’s own firewall; both must allow the traffic.
• Containers that publish ports can add their own rules that bypass ufw’s view of the world. Check your container runtime’s documentation when exposing ports.

Official documentation

• firewall-cmd manual
• firewalld rich language
• ufw(8) on Ubuntu