How to unblock ports in the Linux firewall with UFW

Learn step by step how to manage access rules and diagnose rejected connections quickly in the terminal using UFW on Linux.

Marcio Cunha•4 min

Also available in:Português Español

Summary

UFW simplifies firewall rule management on Linux without requiring complex low-level commands.
Checking the current service status prevents accidental lockouts of remote access during configuration.
Opening specific ports ensures that network services like web servers accept external connections securely.
Consulting rejected connection logs speeds up the identification of communication failures in the network.
Complementing UFW with blocking tools like fail2ban enhances overall server protection.

What is UFW and why use it on Linux?

When running a server or computer connected to the internet, digital security becomes an absolute priority. Every modern operating system uses a firewall, which acts like a strict doorman controlling incoming and outgoing network traffic. In the Linux ecosystem, the traditional low-level tool is called iptables, but creating rules there can be extremely complex and time-consuming for daily operations.

This is exactly where UFW comes in, standing for Uncomplicated Firewall. It was created specifically to simplify the lives of system administrators and developers, offering a clean, friendly terminal interface to manage security rules without headaches. In practice, managing access rules and diagnosing rejected connections quickly in the terminal stops being a daunting challenge and becomes a straightforward maintenance task.

How to check the current status and enable the firewall

Before making any changes to security rules, the first essential step is to find out if the firewall is already running and which ports are currently open. For this, we use the status check command in the terminal with administrative privileges. It is worth noting that modifying a firewall remotely via SSH requires caution to avoid locking yourself out of the server.

To check the current system situation, open your terminal and run the command below. It will show whether the service is active and list all registered permissions so far, making it easier to map out the infrastructure before any operational changes.

sudo ufw status verbose

If the system reports that the firewall is inactive, you will need to enable it to start protecting your environment. Before turning on the main switch, ensure that your remote access port—usually port 22 for SSH connections—is properly allowed to prevent connection loss. To turn on UFW safely, use the corresponding terminal command.

sudo ufw enable

How to open specific ports and addresses step by step

With the firewall active and running, the next step in system administration is opening the necessary ports for your applications to function. If you have installed a web server, for instance, you will need to open standard HTTP and HTTPS ports to allow public user access.

To open a specific port, we use the allow command followed by the desired port number. Below is the recommended sequence of commands to configure basic web server access on your Linux machine.

Allow the standard port for secure web traffic using the command:
```
sudo ufw allow 443/tcp
```
Allow the standard port for regular web traffic with the command:
```
sudo ufw allow 80/tcp
```
Verify that the rules were applied correctly by listing the updated status:
```
sudo ufw status numbered
```

Beyond opening simple numeric ports, UFW allows restricting access exclusively to trusted IP addresses or entire networks. This approach is excellent for corporate environments where only specific headquarters machines should access internal database services or restricted admin panels.

How to diagnose rejected connections and network errors

One of the biggest challenges in system administration is figuring out why an application cannot communicate with the outside world. Often, the problem lies not in software code, but rather in restrictive firewall rules silently dropping data packet traffic.

To diagnose these issues quickly in the terminal, we need to enable UFW logging. When enabled, the firewall records all blocked connection attempts in the system logs, allowing for precise forensic analysis of network activity. To enable detailed logging, run the configuration command.

sudo ufw logging on

With logging enabled, you can monitor operating system messages in real-time to identify suspicious IPs or ports being scanned by automated bots on the internet. In more complex network diagnostic scenarios, checking the firewall aligns perfectly with other maintenance routines, such as cleaning the systemd journal cache and freeing up disk space on Linux to ensure sufficient room for ongoing log and system file storage. To complement this implementation in production environments, see our related technical analyses on How to test LCD backlight circuits on the bench and How to clean APT package cache and free disk space on Linux.

Final thoughts on security and maintenance

Managing a firewall with UFW is a core skill for any system administrator looking to keep Linux environments secure, organized, and easy to audit. Throughout this tutorial, we covered everything from basic operational concepts to practical port opening and diagnosing rejected connections directly from the terminal.

Maintaining a disciplined routine of rule reviews and log monitoring prevents intrusions and ensures that only legitimate traffic flows through your infrastructure. Always combine proper UFW usage with software update best practices and constant monitoring to build a highly resilient environment prepared for incidents.