How to Open Ports in Linux Server Firewall

This updated guide examines How to Open Ports in Linux Server Firewall and organizes the essential facts, background, and practical takeaways in clear American English.

Method 1of 3:

Using Uncomplicated Firewall for Ubuntu

1. Log in to your server. If you're using Ubuntu on your desktop, pressCtrl+Alt+Tto open a terminal window.
2. Typesudo ufw status verboseand press↵Enter. If UFW is already running, you'll see a status message, as well as a list of any firewall rules (including opened ports) that already exist.^[1]
   • If you see a message that says Status: inactive , typesudo ufw enableat the prompt and press↵Enterto start the firewall.
3. Usesudo ufw allow [port number]to open a port. For example, if you want to open the SSH port (22), you'd typekbdand press↵Enterto open the port. There's no need to restart the firewall, as the change will take effect immediately.^[2]
   • If the port you're opening is for a service listed in/etc/services, you just type the service's name instead of the port number. Example:sudo ufw allow ssh.
   • To open a specific range of ports, use the syntaxsudo ufw allow 6000:6007/tcp, replacing6000:6007with the actual range. If the range is UDP ports, replacetcpwithudp.
   • To specify an IP address that can access the port, use this syntax:sudo ufw allow from 10.0.0.1 to any port 22. Replace10.0.0.1with the IP address, and22with the port you want to open to that address.
4. Delete firewall rules that aren't needed. Any ports that aren't specifically opened are blocked by default. If you open a port and decide you want to close it, use these steps:
   • Typesudo ufw status numberedand press↵Enter. This displays a list of all firewall rules, each beginning with a number to represent it in the list.
   • Identify the number at the beginning of rule you want to delete. For example, let's say you want to remove the rule that opens port 22, and that rule is listed on line 2.
   • Typesudo ufw delete 2and press↵Enterto remove the rule at line 2.

Method 2of 3:

Using ConfigServer Firewall

1. Log in to your server. If you're not logged in as the root user, you cansuto root to adjust your configuration.
2. Go to directory that contains your CSF config file. The file is calledcsf.conf, and it's saved to/etc/csf/csf.confby default.^[3]To do this, typecd /etc/csfand press↵Enter.
3. Opencsf.confin a text editor. You can use any text editor you wish, such as vim or nano.
   • To open csf.conf in vim, typevim csf.configand press↵Enter.
4. Add an incoming port to theTCP_INlist. TCP ports. Once you have the file open, you will seeTCP_INandTCP_OUTsections. TheTCP_INsection lists open inbound TCP ports separated by commas. The ports are in numerical order to make things easy, but it's not required that the ports you stick to the order. You can add ports to the end of the sequence, just separate them with commas.
   • For example, let's say you want to open port 999, and the current open ports are20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995.
   • After adding port 999 to the list, it will look like this:20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 999.
   • To get into insertion/typing mode in vim, press theikey on the keyboard.
5. Allow outgoing TCP to theTCP_OUTlist. Just as you did with the incoming port, add any outbound TCP ports you'd like to open to theTCP_OUTlist.
6. Save your changes and exit the file. Follow these steps to save and exit the file:
   • Press theEsckey.
   • Type:wq!.
   • Press↵Enter.
7. Typeservice csf restartand press↵Enter. This restarts the firewall and opens the new ports.
   • To deny a port, re-open the file, delete the port, save the file, and then re-start the firewall.

Method 3of 3:

Using Advanced Policy Firewall

1. Log in to your server. If you're not logged in as the root user, you cansuto root to adjust your configuration.
2. Go to the directory that contains your APF config file. The file you're looking for is calledconf.apf, and it'll be in/etc/apfby default.^[4]Typecd /etc/apfto enter that directory.
3. Openconf.apfin a text editor. You can use any text editor you wish, such as vim or nano.
   • To open conf.apf in vim, you'd typevim conf.apfand press↵Enter.
4. Add inbound ports to theIG_TCP_CPORTSlist. Once you have the file open, you will seeIG_TCP_CPORTSandEG_TCP_CPORTSsections. TheIG_TCP_CPORTSsection lists open inbound ports separated by commas. The ports are listed in numerical order to make things easy, but it's not required to stick with it. You can add ports to the end of the sequence, just separate them with commas.
   • For example, let's say you want to open port 999, and the current open ports are20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995.
   • After adding port 999 to theIG_TCP_CPORTSlist, it will look like this:20, 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 999.
   • To get into insertion/typing mode in vim, press theikey on the keyboard.
5. Allow outbound ports to theEG_TCP_CPORTSlist. Just as you did with the incoming port, add any outbound TCP ports you'd like to open to the theEG_TCP_CPORTSlist.
6. Save your changes and exit the file. Follow these steps to save and exit the file:
   • Press theEsckey.
   • Type:wq!.
   • Press↵Enter.
7. Typeservice apf -rand press↵Enter. This restarts the APF firewall and opens the new ports.
   • To deny a port, re-open the file, delete the port, save the file, and then re-start the firewall.