Updated: 11 October 2026 · Applies to: UFW 0.36.2 on Ubuntu 26.04 LTS and 24.04 LTS (the same on Debian 13), tested

To open a port on Ubuntu, allow it in UFW, Ubuntu’s firewall tool: sudo ufw allow 8080/tcp. If UFW is not switched on yet, allow SSH first and then enable it, or you lock yourself out of a remote server:

sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status

UFW (Uncomplicated Firewall) is in Ubuntu’s standard package set and stays inactive until you enable it. If ufw is missing, install it with sudo apt install ufw.

Set up UFW on a new server

  1. Check the status. A new server shows Status: inactive: 
    sudo ufw status verbose
  2. Set the default policies (these are also the package defaults): 
    sudo ufw default deny incoming
sudo ufw default allow outgoing
  3. Allow SSH. These three commands create the same rule for port 22/tcp; in our test the third one answered Skipping adding existing rule: 
    sudo ufw allow OpenSSH      # application profile from the openssh-server package
sudo ufw allow ssh          # service name, looked up in /etc/services
sudo ufw allow 22/tcp       # port number
    If SSH listens on another port, allow that port instead, for example sudo ufw allow 2222/tcp (see change the SSH port safely).
  4. Enable the firewall: 
    sudo ufw enable
    Over SSH, UFW asks first: Command may disrupt existing ssh connections. Proceed with operation (y|n)?. Answer y only when step 3 is done. It then prints Firewall is active and enabled on system startup, and the rules survive a reboot.

Installed software can bring its own profiles. Lab example on Ubuntu 26.04 with OpenSSH and nginx installed:

$ sudo ufw app list
Available applications:
  Nginx Full
  Nginx HTTP
  Nginx HTTPS
  Nginx QUIC
  OpenSSH
$ sudo ufw app info OpenSSH
Profile: OpenSSH
Title: Secure shell server, an rshd replacement
Description: OpenSSH is a free implementation of the Secure Shell protocol.

Port:
  22/tcp

Open ports with ufw allow

sudo ufw allow 8080/tcp                                   # one TCP port
sudo ufw allow 51820/udp                                  # one UDP port
sudo ufw allow 80,443/tcp                                 # a list of ports
sudo ufw allow 60000:61000/udp                            # a range
sudo ufw allow "Nginx Full"                               # by profile (80 and 443)
sudo ufw allow from 203.0.113.5 to any port 3306 proto tcp   # one IP address only
sudo ufw allow in on eth0 to any port 8443 proto tcp      # one network interface
sudo ufw limit OpenSSH                                    # SSH with rate limiting
  • Give the protocol. According to the UFW manual, sudo ufw allow 53 opens both TCP and UDP. The same applies to the long form: in our test ufw allow from 203.0.113.0/24 to any port 22 without proto tcp created a TCP and a UDP rule.
  • A list or range of ports needs the protocol. sudo ufw allow 80,443 fails with ERROR: Must specify 'tcp' or 'udp' with multiple ports.
  • Each rule is created for IPv4 and IPv6, because /etc/default/ufw contains IPV6=yes: UFW answers Rule added and Rule added (v6) when it is active, or Rules updated and Rules updated (v6) before you enable it. A rule for one IPv4 address is created for IPv4 only.
  • limit allows the port but, according to the manual, denies an address that opens 6 or more connections within 30 seconds. Use it instead of allow for SSH, not as well.
  • Open databases, admin panels and other private services for your own IP address only, as in the MySQL example.

On an active firewall a new rule works at once (in our test it appeared in the live iptables rules straight away); there is no need to reload. To open a port in Windows instead, see open a port in Windows Firewall; on AlmaLinux and Rocky Linux, see open a port with firewalld.

Check the rules and the open port

Lab output from our test rules, shortened to the IPv4 rules (8080 and the 203.0.113.0/24 rule for port 22 were added without a protocol):

$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
8080                       ALLOW IN    Anywhere
80,443/tcp                 ALLOW IN    Anywhere
80,443/tcp (Nginx Full)    ALLOW IN    Anywhere
3306/tcp                   ALLOW IN    203.0.113.5
22                         ALLOW IN    203.0.113.0/24
8443/tcp on eth0           ALLOW IN    Anywhere

8080 and 22 without /tcp are the TCP-and-UDP rules from commands without a protocol. sudo ufw show added lists the rules as the commands you typed. A rule only lets traffic through to a program that listens, so check both sides:

$ sudo ufw show listening
tcp:
  8080 * (nc.openbsd)
   [ 1] allow 8080/tcp

This shows each public listening port with the rules that match it. Then test from another computer with nc -zv SERVER_IP 8080: how to check open ports in Linux explains the results.

Order and delete rules

Lab output, shortened to the first three rules:

$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] OpenSSH                    ALLOW IN    Anywhere
[ 2] 8080                       ALLOW IN    Anywhere
[ 3] 80,443/tcp                 ALLOW IN    Anywhere

UFW checks rules from the top and the first match wins. A deny rule added at the bottom is never reached by traffic that an earlier rule allows, so put it at the top with insert:

sudo ufw insert 1 deny from 198.51.100.0/24   # block a network before the allow rules
sudo ufw delete allow 8080                     # delete by repeating the rule
sudo ufw delete 2                              # delete by number (asks to confirm)

After deleting by number, run sudo ufw status numbered again: the remaining rules are renumbered. More on blocking: block a port on Linux and Windows.

Reload, disable or reset UFW

sudo ufw reload    # Firewall reloaded
sudo ufw disable   # Firewall stopped and disabled on system startup
sudo ufw reset     # delete all rules

In our test, ufw reset saved each rule file in /etc/ufw with the date and time added to its name (for example before6.rules.20261010_131552) and left the firewall inactive. For firewalld and CSF, see how to disable the firewall on Linux.

Docker ignores UFW rules

According to Docker’s documentation, ports published with docker run -p are routed before UFW’s rules are checked, so a container can be reachable even when UFW does not allow the port. Publish private services on localhost only, for example -p 127.0.0.1:8080:80, and put a web server or reverse proxy in front.

Locked out after ufw enable?

  1. Open the VNC console from the client area: access your VPS through VNC.
  2. Log in and run sudo ufw allow OpenSSH (or your custom SSH port), or sudo ufw disable.
  3. Connect over SSH again, then fix the rules.

Official documentation: Ubuntu Server: Firewall and ufw manual page.

Ucartz services for this topic

Was this answer helpful? 0 Users Found This Useful (0 Votes)