How to Open a Port in Linux and Ubuntu: Firewall Commands

Updated: 18 October 2026 · Applies to: UFW 0.36.2 (Ubuntu 24.04 and 26.04, Debian 13), firewalld 2.3 and 2.4 (AlmaLinux and Rocky Linux 9 and 10, Debian 13), nftables 1.1 and iptables 1.8.11, tested

To open a port in Linux, allow it in the firewall your server uses, and make sure a program is listening on it. The command depends on the firewall:

• Ubuntu and Debian with UFW: sudo ufw allow 8080/tcp
• AlmaLinux, Rocky Linux, RHEL and Fedora (firewalld): sudo firewall-cmd --permanent --add-port=8080/tcp and then sudo firewall-cmd --reload
• Plain nftables: sudo nft add rule inet filter input tcp dport 8080 accept, and add the port to /etc/nftables.conf so it survives a reboot
• Plain iptables: sudo iptables -I INPUT -p tcp --dport 8080 -j ACCEPT, then save the rules

Replace 8080 with your port and use /udp for UDP services (games, VPN, DNS). Use only one firewall tool on a server: UFW and firewalld write their own rules and replace anything you add by hand.

1. Find out which firewall is active

sudo ufw status            # "Status: active" means UFW is in charge
sudo firewall-cmd --state  # "running" means firewalld is in charge
sudo nft list ruleset      # shows the kernel rules behind both

UFW is installed on Ubuntu but stays inactive until you enable it. firewalld is the firewall on AlmaLinux, Rocky Linux and RHEL; firewall-cmd --state prints not running when it is installed but stopped. Debian installs nftables but leaves its service off, so a new Debian server has no active firewall. On cPanel servers, CSF often manages the firewall (see step 6).

2. Check that a program listens on the port

A firewall rule only lets traffic through. Something must accept it, and it must listen on the right address:

$ sudo ss -tlnp
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      5          127.0.0.1:8081      0.0.0.0:*    users:(("python3",pid=763,fd=3))
LISTEN 0      5            0.0.0.0:8080      0.0.0.0:*    users:(("python3",pid=762,fd=3))

(Lab example.) Port 8080 listens on 0.0.0.0, every address, so other computers can reach it. Port 8081 listens on 127.0.0.1 only: even with the port allowed in the firewall, our test from another machine got Connection refused. Change the program's bind or listen address in its configuration and restart it. Use ss -ulnp for UDP. More in How to Check Open Ports in Linux and Ubuntu.

3. Ubuntu and Debian: open a port with UFW

1. On a remote server, allow SSH before you enable UFW, or you lock yourself out: sudo ufw allow 22/tcp (use your own SSH port if you changed it).
2. Allow your port: sudo ufw allow 8080/tcp
3. Enable the firewall if it is inactive: sudo ufw enable (answer y).
4. Check the rules: sudo ufw status

$ sudo ufw allow 8080/tcp
Rule added
Rule added (v6)
$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
8080/tcp                   ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
8080/tcp (v6)              ALLOW       Anywhere (v6)

While UFW is inactive, the same command prints Rules updated: the rule is stored and applies once you enable UFW. Other forms we tested:

sudo ufw allow 51820/udp                                   # a UDP port
sudo ufw allow 6000:6007/tcp                               # a range (protocol required)
sudo ufw allow from 203.0.113.50 to any port 3306 proto tcp  # one source IP only
sudo ufw delete allow 8080/tcp                             # remove the rule again

UFW drops blocked packets, so a client sees a timeout rather than an error. Full UFW guide: How to Open Ports on Ubuntu with UFW.

4. AlmaLinux, Rocky Linux, RHEL and Fedora: open a port with firewalld

firewalld has a running (runtime) configuration and a saved (permanent) one. A rule added without --permanent works at once but disappears at the next reload or reboot. In our lab, port 8080 opened with firewall-cmd --add-port=8080/tcp and closed again after firewall-cmd --reload. The reliable way:

$ sudo firewall-cmd --permanent --add-port=8080/tcp
success
$ sudo firewall-cmd --reload
success
$ sudo firewall-cmd --list-ports
8080/tcp

More forms:

sudo firewall-cmd --permanent --add-port=51820/udp      # UDP
sudo firewall-cmd --permanent --add-port=6000-6007/tcp  # a range uses a hyphen here
sudo firewall-cmd --permanent --add-service=https       # a known service (port 443)
sudo firewall-cmd --runtime-to-permanent                # save tested runtime changes
sudo firewall-cmd --list-all                            # everything in the zone

The rules apply to the default zone (public), unless you add --zone=NAME. To allow a port for one IP address only, see How to Enable Port for a Specific IP Address in Firewalld; for listing rules, Useful firewall-cmd Examples for firewalld.

5. Plain nftables or iptables

With nftables (the kernel framework behind modern Linux firewalls), a rule added with nft is lost at reboot. Add it at runtime and also to /etc/nftables.conf, which the nftables service loads at boot:

sudo nft add rule inet filter input tcp dport 8080 accept   # table inet filter is Debian's default

# /etc/nftables.conf, in the input chain:
		tcp dport { 22, 80, 443, 8080 } accept
		udp dport 51820 accept

sudo nft -c -f /etc/nftables.conf     # check the file, no output = OK
sudo systemctl enable --now nftables  # load it at boot (Debian)

A typo is caught before anything changes: Error: syntax error, unexpected string, with the line marked.

With iptables, the order of rules matters. Most rule sets end with a REJECT or DROP rule, and iptables -A appends after it, so the port stays closed. In our lab the appended rule was number 5, after REJECT, and the client got No route to host. Insert the rule at the top with -I instead:

sudo iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
sudo iptables -L INPUT -n --line-numbers

iptables rules also vanish at reboot. On Debian and Ubuntu, install iptables-persistent and run sudo netfilter-persistent save; the rules go to /etc/iptables/rules.v4 and rules.v6. On AlmaLinux and Rocky Linux, use firewalld instead.

6. cPanel servers with CSF

If ConfigServer Security and Firewall (CSF) is installed, add the port to TCP_IN (and TCP6_IN for IPv6; UDP_IN for UDP) in /etc/csf/csf.conf, for example TCP_IN = "20,21,22,25,...,8443,8080", then restart CSF and lfd with sudo csf -ra. Do not add iptables rules by hand on a CSF server; CSF replaces them. See How to Unblock or Whitelist an IP in ConfigServer Security and Firewall.

7. Test the port from another computer

nc -zv -w 3 203.0.113.10 8080

What the answers meant in our lab:

• Connection to 203.0.113.10 8080 port [tcp/http-alt] succeeded!: the port is open.
• timed out: Operation now in progress: a firewall drops the traffic (UFW, a router or a network firewall).
• Connection refused: nothing listens on that address, or a firewall rejects the connection.
• No route to host: a REJECT rule with an ICMP message, as in the iptables example.

Test from outside the server: a test from the server itself goes through the loopback interface, which firewalls normally allow. If the server allows the port but it still looks closed, check firewalls in front of it: a home router needs port forwarding, and a cloud or hardware firewall needs its own rule. Docker publishes container ports past UFW. More testing tips: How to Test Port Connectivity with nc (netcat) on Linux.

Open only the ports you need and limit admin and database ports to your own IP address. To close a port again, see How to Close or Block a Port on Linux and Windows Server; for Windows, How to Open a Port in Windows Firewall and Check It Is Open.

Official documentation: ufw manual, firewall-cmd manual and Debian nftables wiki.