How to Open a Port in Linux: ufw and iptables
The simplest way to open a port in Linux is ufw: sudo ufw allow 443/tcp. For fine-grained control you use iptables: sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT. Below are both methods, including how to persist the rules so the port stays open after a reboot.
Method 1. ufw (the simple firewall)
ufw is a friendly front end for iptables, available by default on Ubuntu and Debian.
Step 1. Check the status
sudo ufw status verbose
If ufw is inactive, always allow SSH before enabling it, otherwise you lock yourself out:
sudo ufw allow 22/tcp
sudo ufw enable
Step 2. Open the port you need
sudo ufw allow 443/tcp
sudo ufw allow 80/tcp
Open a UDP port or a range:
sudo ufw allow 53/udp
sudo ufw allow 6000:6010/tcp
Allow a port from one source IP only:
sudo ufw allow from 203.0.113.5 to any port 5432 proto tcp
Step 3. Review the rules
sudo ufw status numbered
Delete a rule by its number:
sudo ufw delete 3
Method 2. iptables (low-level control)
iptables gives you full control over the rule chains.
Open a port
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
A cleaner form allows only new and established connections:
sudo iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
List the rules
sudo iptables -L INPUT -n --line-numbers
Delete a rule
sudo iptables -D INPUT 2
Persisting iptables rules
By default, iptables rules are lost on reboot. Save them with the netfilter-persistent package:
sudo apt install iptables-persistent
sudo netfilter-persistent save
ufw or iptables: which one to use
| Criterion | ufw | iptables |
|---|---|---|
| Ease of use | high | low |
| Flexibility | moderate | maximum |
| Rule persistence | automatic | needs netfilter-persistent |
| Best for | everyday tasks | complex NAT and routing setups |
Do not mix manual iptables rules with ufw on the same server — manage the firewall with one tool.
Named application profiles in ufw
ufw works not only with port numbers but also with ready-made application profiles. List what is available:
sudo ufw app list
Open all ports of an application with a single rule (for example, Nginx on both 80 and 443):
sudo ufw allow "Nginx Full"
It is easier than memorising port numbers and reduces the risk of a typo.
Rate limiting connection attempts
ufw can limit how often new connections to a port are accepted — useful for SSH to slow down password guessing. The limit rule blocks an IP that makes 6 or more connections within 30 seconds:
sudo ufw limit 22/tcp
This is no substitute for key-based authentication, but it cuts down the noise from automated brute-force bots.
Verifying that the port is open
Locally, the service must be listening on the port:
sudo ss -tulpn | grep :443
From outside, check reachability from another host:
nmap -p 443 203.0.113.10
Frequently asked questions
I opened the port but it is still unreachable — why?
The port is open in the firewall, but either no service is listening on it or there is a second firewall (your provider’s cloud security group). Check ss -tulpn and the network settings in the control panel.
ufw enable killed my SSH session — what now?
Always add ufw allow 22/tcp before enabling ufw. If you already lost access, restore it through the KVM console.
My iptables rules disappeared after a reboot — what do I do?
iptables does not persist rules by itself. Install iptables-persistent and run netfilter-persistent save.
How do I close a port temporarily?
In ufw, run sudo ufw deny 443/tcp or delete the allow rule. In iptables, delete the rule with -D.
Do I need to open ports for outbound connections? No. The default OUTPUT policy permits outbound traffic. You open inbound (INPUT) ports for the services you host.
Need a server with root access and a firewall of your own? Deploy a Linux VPS in the VPS hosting section or order server administration.