How to unblock ports on Linux UFW firewall

How the UFW firewall protects your Linux server

Managing server security requires strict control over incoming and outgoing network traffic. UFW, or Uncomplicated Firewall, acts as a friendly configuration layer for the native Linux kernel packet filtering system. In practice, it decides which network connections are allowed and which are blocked based on predefined rules, preventing unauthorized access to sensitive services.

In production environments, keeping unnecessary ports open exposes applications to malicious scans and brute-force attacks. Understanding how UFW operates ensures that only legitimate traffic reaches running services. Before modifying any security rule, it is essential to analyze active TCP connections on the operating system to identify which services truly require external access.

How to check current status and listening ports

Before opening any port, we need to know the current state of the firewall and which services are running on the machine. The UFW status command shows whether it is active and which rules are already registered. To check this in the terminal, run the basic check command with administrative privileges.

sudo ufw status verbose

To ensure that the service you want to unblock is actually active and awaiting connections, use diagnostic tools to list listening ports. If a port is not associated with any active process, opening it in the firewall will not solve external connection issues. In cases where a port is occupied by another unwanted process, you must stop the competing service before proceeding with final opening.

How to securely open TCP and UDP ports

When a web application or database needs to receive external connections, you must instruct the firewall to accept this data flow. UFW allows opening specific ports by specifying the port number and corresponding protocol. For example, to open the standard port for secure web servers, we use the command below.

sudo ufw allow 443/tcp

The TCP protocol ensures reliable data delivery, making it ideal for HTTP, SSH, and databases. On the other hand, streaming services, DNS, or games use the UDP protocol because they prioritize speed over delivery confirmation. To open UDP ports, simply change the suffix in the command. It is recommended to read about how to diagnose network packet loss if communication failures occur even after opening the port correctly.

How to restrict access to specific IP addresses

Opening a port to the entire world, represented by the universal address 0.0.0.0/0, can pose a considerable security risk on database servers or administrative panels. UFW allows specifying restrictive rules that accept traffic only from trusted IP addresses, such as the company internal network or office IP.

sudo ufw allow from 192.168.1.50 to any port 3306 proto tcp

This approach protects critical services against automated intrusion attempts coming from the public internet. If the server needs to communicate with other equipment on the local network, ensure the network configuration is stable by following best practices like setting a static IP address on Linux to prevent routing drops.

How to remove incorrect rules and validate the firewall

Errors in creating firewall rules can block administrative access to the server, requiring extra attention when managing ports. To list all active rules accompanied by their respective index numbers, run the numbered command that facilitates removal.

sudo ufw status numbered

If a rule was registered incorrectly, you can delete it by providing the corresponding number obtained from the previous listing. This practice prevents the accumulation of obsolete rules that clutter the operating system security configuration. Additionally, server maintenance routines may include processes like cleaning Docker cache on Linux to free up disk space without affecting container network rules.

Conclusion and network security best practices on Linux

Proper administration of the UFW firewall is an indispensable pillar for keeping Linux servers secure and stable in production environments. By opening only strictly necessary ports, specifying TCP or UDP protocols precisely, and restricting access to trusted IPs, you drastically reduce the attack surface against your infrastructure.

Maintaining an audit routine of active rules and monitoring listening port behavior ensures unauthorized changes are identified quickly. Combine the use of UFW with system administration best practices to ensure high availability and continuous protection for your networked services.