How to Disable the Firewall on Linux (firewalld, UFW, CSF)

Updated: 28 September 2026 · Applies to: firewalld on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; UFW on Ubuntu 24.04 and 26.04 and Debian 13; nftables; CSF

Turning the firewall off is sometimes needed for a short test: to find out whether the firewall is what blocks a service. It should never stay off on a server with a public IP address. In most cases the better fix is to open the one port you need, shown at the end of each section.

Which firewall is running?

systemctl is-active firewalld ufw nftables csf 2>/dev/null

Each line answers active or inactive, in the order asked. AlmaLinux, Rocky Linux and RHEL use firewalld; Ubuntu uses UFW; cPanel servers often use CSF.

firewalld (AlmaLinux, Rocky Linux, RHEL)

firewall-cmd --state             # running?
systemctl stop firewalld         # off until the next reboot
systemctl disable firewalld      # also off after reboots

Turn it back on with systemctl enable --now firewalld.

Better: open just the port, for example firewall-cmd --permanent --add-port=8080/tcp && firewall-cmd --reload.

UFW (Ubuntu, Debian)

ufw status          # running?
ufw disable         # off, also after reboots

Turn it back on with ufw enable. Before enabling UFW on a remote server, allow SSH first (ufw allow OpenSSH), or you lock yourself out.

Better: ufw allow 8080/tcp.

CSF (common on cPanel servers)

csf -x        # disable CSF and LFD
csf -e        # enable them again

Better: add the port to TCP_IN in /etc/csf/csf.conf and run csf -r.

Plain nftables

If none of the above runs, rules may be loaded directly into nftables. See them with nft list ruleset. systemctl stop nftables removes the rules loaded by that service; nft flush ruleset removes all rules until the next reboot or reload.

After the test

1. If the service works with the firewall off, the firewall was the cause: turn it back on and open only the port you need.
2. If the service still fails with the firewall off, the cause is elsewhere: the service itself, its listen address, SELinux, or a firewall outside the server. See troubleshooting connection refused.

Official documentation: firewalld documentation and ufw manual page.