How to Turn Off the Firewall on Linux (firewalld, UFW, CSF)

Updated: 18 October 2026 · Applies to: firewalld 2.4.3 on AlmaLinux 10.2 and UFW 0.36.2 on Ubuntu 26.04 (tested); the same commands work on Rocky Linux and RHEL 9 and 10, Ubuntu 24.04 and Debian 13; CSF on cPanel servers (from its manual)

To turn off the firewall on Linux, run sudo systemctl stop firewalld on AlmaLinux, Rocky Linux and RHEL (add sudo systemctl disable firewalld to keep it off after a reboot), sudo ufw disable on Ubuntu and Debian, or sudo csf -x on a cPanel server with CSF. Do this only for a short test. In almost every case the better fix is to open the one port you need, as shown in each section.

Before you turn it off

• The risk: with the firewall off, every program that listens on the server's public IP address can be reached from the internet, including databases and admin panels that were never meant to be public. Keep the test short.
• Turning the firewall off does not lock you out; turning it back on can, if SSH is not allowed in the rules. Know your way back in first: on a Ucartz VPS that is the VNC console in Virtualizor (How to Access Your VPS via VNC in Virtualizor); on a dedicated server with IPMI, its KVM console.
• Better options: open a port (How to Open Port in Linux?) or close one (How to Close or Block a Port on Linux and Windows Server).

1. Find out which firewall is running

sudo firewall-cmd --state       # firewalld: running or not running
sudo ufw status                 # UFW: Status: active or inactive
sudo nft list tables            # every nftables table loaded by any tool

A quick look at several services at once, lab example from AlmaLinux 10 with firewalld running:

$ systemctl is-active firewalld ufw nftables csf
active
inactive
inactive
inactive

The answers come in the order asked. inactive is also printed for a service that is not installed at all (ufw and csf were not on this server), so use the commands above to be sure. AlmaLinux, Rocky Linux and RHEL use firewalld; Ubuntu uses UFW; cPanel servers often use CSF.

2. firewalld (AlmaLinux, Rocky Linux, RHEL, Fedora)

1. Stop it (off until the next reboot):

   $ sudo systemctl stop firewalld
   $ sudo firewall-cmd --state
   Waiting on dbus connection...
   not running

   In our test, nft list tables printed nothing after the stop: firewalld removes its rules when it stops, so all traffic is allowed unless another tool loaded rules of its own.
2. Keep it off after a reboot:

   $ sudo systemctl disable firewalld
   Removed '/etc/systemd/system/multi-user.target.wants/firewalld.service'.
   Removed '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'.

3. Optional: stop other programs from starting it again with sudo systemctl mask firewalld. A masked service refuses to start: Failed to start firewalld.service: Unit firewalld.service is masked.

Turn it back on with sudo systemctl unmask firewalld (only if you masked it) and sudo systemctl enable --now firewalld. A new firewalld setup allows SSH in its default zone (services: cockpit dhcpv6-client ssh on AlmaLinux), so this does not lock you out unless someone removed that rule.

Better: open the port for a limited time only. This rule disappears by itself after 10 minutes:

$ sudo firewall-cmd --add-port=8080/tcp --timeout=10m
success

For a permanent rule, see How to Open a Port in the Firewall on RHEL, AlmaLinux and Rocky Linux.

3. UFW (Ubuntu, Debian)

$ sudo ufw disable
Firewall stopped and disabled on system startup

This one command turns UFW off now and after reboots: it sets ENABLED=no in /etc/ufw/ufw.conf, and in our test the iptables policies changed from -P INPUT DROP to -P INPUT ACCEPT. Your rules are kept for later.

To turn it back on, allow SSH first, then enable:

$ sudo ufw allow 22/tcp
$ sudo ufw enable
Firewall is active and enabled on system startup

If your SSH server listens on another port, allow that port instead. Over an SSH connection, ufw enable first asks Command may disrupt existing ssh connections. Proceed with operation (y|n)?

Better: sudo ufw allow 8080/tcp opens one port and prints Rule added and Rule added (v6). More in How to Open Ports on Ubuntu with UFW (Allow SSH and Enable).

4. CSF (common on cPanel servers)

sudo csf -x     # disable csf and lfd completely
sudo csf -e     # enable them again

According to the CSF manual, csf -f only flushes the rules for the moment, and lfd may restart csf, so use csf -x for a test. cPanel now develops CSF in its own GitHub repository (cpanel-csf); according to that repository, the cpanel-csf package is intended for cPanel and WHM servers only.

Better: add the port to TCP_IN (and TCP6_IN for IPv6) in /etc/csf/csf.conf, then run sudo csf -ra, which restarts both csf and lfd as the manual asks after configuration changes. If CSF blocked your own IP address, see How to Unblock or Whitelist an IP in ConfigServer Security and Firewall?

5. Plain nftables

If none of the above runs, rules may be loaded directly into nftables. See them with sudo nft list ruleset. sudo nft flush ruleset removes all rules until the next reboot or reload. On AlmaLinux 10, stopping the nftables service (systemctl stop nftables) runs that same flush, so it also removes rules that other tools such as firewalld added. To start, stop and switch between firewalld and iptables, see How to Start/Stop and Enable/Disable FirewallD and Iptables Firewall in Linux?

6. After the test

1. If the service works with the firewall off, the firewall was the cause: turn it back on and open only the port you need.
2. If the service still fails with the firewall off, the cause is elsewhere: the service itself, its listen address, SELinux, or a firewall outside the server. See Troubleshooting Connection refused from Remote Servers on Linux.
3. Turn the firewall back on and confirm with firewall-cmd --state or ufw status.

Locked out? Log in through the VNC console of your VPS (or the IPMI KVM console of a dedicated server) and run sudo ufw allow 22/tcp or sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload, or turn the firewall off there with the commands above. For Windows Server, see How to Open a Port in Windows Firewall and Check It Is Open.

Official documentation: firewalld documentation, ufw manual page and cPanel CSF repository.