To open a port on a Linux VPS with UFW, first allow the SSH service or your custom SSH port, then add an allow rule for the application, enable UFW, and verify the resulting policy. For example, an inbound TCP service on port 8080 uses sudo ufw allow 8080/tcp. Enabling UFW without first allowing SSH can cut off a remote session, so the order of operations matters.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
UFW changes the firewall on the VPS itself. It does not start an application, make a service listen, or override a hosting provider’s firewall, security group, or network ACL. A successful rule therefore has two parts: the host firewall permits the traffic and a service is actually listening on the expected address and port.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat UFW does when you open a port
Ubuntu identifies Uncomplicated Firewall (UFW) as its default firewall configuration tool, and a new installation normally has UFW disabled. UFW provides a simpler command interface for adding and removing common rules rather than exposing every underlying firewall feature.
An allow rule tells the host firewall which packets may pass. It does not reserve the port, install a daemon, configure a web server, or publish the port through a VPS provider’s network perimeter. For an outside client to connect, all of these conditions must be true:
#1 Best Overall
- UFW is enabled and has an allow rule matching the traffic.
- The application is running and listening on the selected port.
- The application is bound to an address reachable from the client, not only to loopback unless that is intentional.
- Any provider-level firewall, security group, or network ACL also permits the connection.
- The client is using the correct protocol, address family, hostname, and port.
Before enabling UFW on a remote VPS
Keep your SSH session safe
Open a second SSH session or keep the current session available while making firewall changes. Before running sudo ufw enable, allow the service and port used by SSH:
sudo ufw allow sshThe service-name rule is convenient when SSH uses its standard port. The equivalent explicit rule is:
sudo ufw allow 22/tcpIf the SSH daemon listens on a different port, replace 22 with that port. For example, an SSH daemon on port 2222 needs:
sudo ufw allow 2222/tcpDo not assume that changing the SSH client command changes the daemon’s listening port. Confirm the port in the server’s SSH configuration or with the administrator who manages the VPS, and make the UFW rule match it exactly. If you are unsure, postpone enabling UFW until you have access to the provider’s web console or another recovery path.
Check the current firewall state
Before adding rules, inspect whether UFW is already active and whether rules exist:
sudo ufw status verboseIf UFW is inactive, the command reports that state. Existing rules still matter: adding a duplicate allow rule is unnecessary and makes later maintenance harder.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Open a port step by step
1. Allow SSH first
Use either the SSH application name or the exact TCP port:
sudo ufw allow sshor:
sudo ufw allow 22/tcpSubstitute your custom SSH port if necessary. This rule should be in place before activation.
2. Add the application rule
For an inbound TCP service on port 8080:
sudo ufw allow 8080/tcpThe same pattern works for other TCP ports. Common examples include:
| Purpose | UFW command | What it permits |
|---|---|---|
| SSH on the standard port | sudo ufw allow 22/tcp |
TCP connections to port 22 from any source |
| HTTP | sudo ufw allow 80/tcp |
TCP connections to port 80 |
| HTTPS | sudo ufw allow 443/tcp |
TCP connections to port 443 |
| Custom web or API service | sudo ufw allow 8080/tcp |
TCP connections to port 8080 |
| Custom UDP service | sudo ufw allow 51820/udp |
UDP traffic to port 51820 |
UFW’s simple port syntax accepts a port and an optional protocol. If you omit the protocol, UFW permits both TCP and UDP for that port. Use the explicit protocol whenever the application requires only one; a TCP-only service does not need a UDP opening.
sudo ufw allow 8080The protocol-omitted form is broader than sudo ufw allow 8080/tcp because it covers both transport protocols.
3. Enable UFW
After the SSH and application rules are present, activate the firewall:
sudo ufw enableUFW may ask for confirmation because enabling it can interrupt existing connections. Confirm only after checking that the SSH rule matches the session you are using.
4. Inspect the resulting policy
Use a verbose status report to see whether UFW is active and which defaults and rules apply:
sudo ufw status verboseFor a numbered list that is easier to reference when deleting or reordering rules, run:
sudo ufw status numberedKeep the output when documenting a production change. It records the rule text, protocol, and whether UFW has separate IPv4 and IPv6 entries.
Choose the narrowest rule that works
A rule can differ in four important ways: transport protocol, source exposure, direction or interface, and whether it is expressed as a raw port or an application profile. The right choice depends on what the service actually needs.
| Decision | Narrower choice | Broader choice and trade-off |
|---|---|---|
| Protocol | Specify /tcp or /udp as required |
Omit the protocol, which allows both TCP and UDP |
| Source | Allow a known IP address or CIDR subnet | Allow from anywhere, exposing the port to all reachable clients |
| Direction | Match inbound traffic and, where needed, a particular interface | Use a general rule that applies to all applicable interfaces |
| Management method | Use a named application profile maintained for that service | Specify a raw port and protocol yourself |
For public HTTP or HTTPS, an anywhere rule is usually intentional because visitors can originate from any address. For administration ports, a source restriction is preferable whenever you have a stable office, VPN, bastion, or management address.
Restrict SSH or another administration port by source
To allow TCP port 22 only from one known public address, use:
sudo ufw allow proto tcp from 203.0.113.10 to any port 22Replace 203.0.113.10 with the address that should administer the VPS. A CIDR subnet can be used when several addresses are trusted:
sudo ufw allow proto tcp from 203.0.113.0/24 to any port 22The source restriction applies to the rule being added; it does not change other SSH rules already present. Check sudo ufw status numbered afterward and remove an unrestricted SSH rule if one is no longer needed. Test a new restricted rule from an allowed network before closing your existing session.
Use an application profile instead of a raw port
Some software packages install a UFW application profile containing a display name and one or more ports. Discover profiles available on the VPS with:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →sudo ufw app listInspect the ports and descriptions attached to a profile by replacing NAME with the displayed profile name:
sudo ufw app info NAMEIf the profile matches the service, allow it by name:
sudo ufw allow 'NAME'Profile definitions live in /etc/ufw/applications.d. A profile can be easier to maintain than a hand-written port rule when the package supplies a meaningful name or groups related ports. If no suitable profile exists, use an explicit port and protocol rule instead. Inspect a profile before allowing it so you know exactly which ports it opens.
Preview a rule with a dry run
UFW can print the rules it would create without applying them. For example, preview the HTTP application rule with:
Recommended Free Tools
sudo ufw --dry-run allow httpThe dry-run output is useful when you are uncertain how a service name, profile, protocol, or address restriction will be interpreted. Review the generated IPv4 and IPv6 entries and then run the command without --dry-run only when the result matches your intention.
Rank #4
Open a port only on a selected interface
A general allow rule applies to matching traffic regardless of which local interface receives it. On a multi-interface VPS, you may want a service reachable only through one interface, such as a private network adapter. UFW supports interface-qualified rules through its extended syntax. For example:
sudo ufw allow in on eth0 to any port 8080 proto tcpReplace eth0 with the actual interface name. Interface-specific rules require careful testing because interface names and routing differ between VPS images. If the service must be reachable publicly, restricting it to a private interface will make it unavailable from the public internet even though the port appears in UFW’s allow list.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsVerify that the service, not just UFW, is ready
Confirm a process is listening
An allow rule does not cause a process to bind to the port. Check the application’s own configuration and service status, then inspect listening sockets on the VPS. A typical Linux check is:
sudo ss -ltnpFor UDP listeners, include UDP sockets as well:
sudo ss -lunpLook for the expected port and address. A listener on 127.0.0.1 accepts connections only from the VPS itself; a service intended for remote clients generally needs to bind to the VPS’s reachable address or to all appropriate local addresses. Binding to all addresses can increase exposure, so pair it with a suitably narrow firewall rule.
Test from an appropriate client
Test TCP connectivity from a machine outside the VPS network, using the public address and exact port. A local test from the VPS can succeed even when an external provider firewall blocks the route, so it is not conclusive for internet reachability. For HTTPS or another protocol with an application-level handshake, test the protocol itself after basic connectivity succeeds.
Check both address families
A hostname may resolve to IPv4, IPv6, or both. UFW can display corresponding rules in its status output. Confirm that the service listens on the address family your client is using and that the provider supplies working IPv6 routing if you expect IPv6 clients to connect.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why a UFW rule can be “open” but the VPS is unreachable
The application is stopped or listening elsewhere
The most common boundary is the service itself. Restart or enable the application according to its package documentation, verify its configured port, and inspect the listening socket. A UFW rule cannot compensate for a crashed process, a typo in the application configuration, or a service bound only to loopback.
The protocol does not match
Opening 8080/tcp does not permit UDP packets on port 8080, and opening 8080/udp does not permit TCP connections. Confirm the protocol documented by the application. If it genuinely needs both, create explicit rules for both or use the protocol-omitted form with the resulting broader exposure understood.
A provider firewall or security group blocks the traffic
Many VPS platforms place a separate firewall, security group, or network ACL outside the guest operating system. That layer can drop traffic before it reaches UFW. Check the provider’s network controls for an inbound rule matching the same port, protocol, source range, and address family. The exact labels and workflow vary by provider, so treat the provider policy as a separate control plane rather than assuming UFW changes it.
Best Value
The wrong address or interface is being tested
Verify the VPS public address, DNS record, destination port, and interface restriction. A rule for a private interface will not make a public address reachable. Likewise, testing an old address after an IP change produces the same symptom as a blocked firewall.
Free tools Windows power users keep installed
One-click scans. No signup required.
Another firewall or application policy intervenes
Container runtimes, web servers, intrusion-prevention tools, and raw firewall rules can add behavior outside the simple UFW rule you created. Check the service’s own access controls and the host’s broader firewall configuration when UFW status looks correct but packets still fail.
Remove, inspect, and maintain rules
Delete by repeating the original rule
To remove the TCP rule for port 8080, repeat its original definition after delete:
sudo ufw delete allow 8080/tcpDeleting by the original rule text is explicit and is useful when you know exactly what should disappear. Where applicable, the original rule form removes both the IPv4 and IPv6 versions of that rule.
Delete by rule number
First display numbered rules:
sudo ufw status numberedThen delete the selected number using the prompt shown by UFW. Be cautious when IPv4 and IPv6 entries are listed separately: deleting a generic rule by number can affect only the specified address-family entry. Re-run sudo ufw status numbered after deletion to confirm the remaining policy.
Review before changing order
Numbered output is also useful before deleting or reordering rules. Keep specific source restrictions and required management access clear, and remove obsolete broad rules rather than leaving overlapping entries that make future audits confusing.
Recover if you lose SSH access
If a firewall change blocks SSH, do not repeatedly retry from the same client. Use the VPS provider’s out-of-band console, serial console, or rescue environment if one is available. From that authenticated console, inspect:
sudo ufw status numberedCorrect or remove the mistaken rule. If necessary, disable UFW temporarily from the console with:
sudo ufw disableRestore the correct SSH allow rule, verify it, and then enable UFW again. Console availability and recovery procedures differ by provider, so establish that access before making restrictive changes on a production VPS.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →UFW’s limits and when to use a different approach
Ubuntu’s documentation describes UFW as an easy interface for adding or removing simple rules, not as a complete firewall-management interface. Its exact scope statement is: “ufw is not intended to provide complete firewall functionality via its command interface, but instead provides an easy way to add or remove simple rules.”
That limitation matters when you need complex routing, advanced packet classification, extensive NAT behavior, or a policy that cannot be expressed as straightforward source, destination, protocol, port, direction, and interface rules. For those requirements, use the firewall and networking tools appropriate to your distribution and architecture, while keeping the simpler UFW policy understandable to whoever will maintain the VPS.
Quick Recap
Practical checklist
- Identify the application’s listening port and whether it uses TCP, UDP, or both.
- Identify the actual SSH port before touching UFW.
- Allow SSH with
sudo ufw allow sshor the exact custom TCP port. - Add the application rule, preferably with an explicit protocol.
- Restrict administrative ports to a known IP or CIDR range when practical.
- Use
sudo ufw --dry-run ...when you need to preview generated rules. - Enable UFW only after the management rule is present.
- Confirm with
sudo ufw status verboseandsudo ufw status numbered. - Verify a process is listening and bound to a reachable address.
- Check the VPS provider’s firewall, security group, and network ACL if external clients still fail.
- Keep console or rescue access available before applying restrictive changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
