Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Manage server ports in five moves: identify what is listening, map each service to its protocol and bind address, permit only the required traffic in your distribution’s firewall, verify from a remote system, and remove anything you do not need. A firewall rule cannot make a stopped service reachable, and a service listening only on loopback is not publicly accessible. The same method works on a VPS and a dedicated server; the exact commands depend on whether the host runs Ubuntu’s UFW frontend or firewalld.
What is an open port, and why does it matter?
Ubuntu Security Documentation defines an open port as “a network port bound to a service and actively listening for incoming connections or packets.” In practical terms, two conditions must be true: a process must be listening on the requested port and the network path must allow the traffic.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →As an Amazon Associate I earn from qualifying purchases.
Port numbers are conventions rather than proof of what a server does. DigitalOcean groups ports 0–1023 as well-known, 1024–49151 as registered or user ports, and 49152–65535 as dynamic or private ports. SSH is commonly associated with 22, HTTP with 80, and HTTPS with 443, but the service configuration is authoritative.
Every reachable listener increases the surface that must be maintained. Ubuntu therefore recommends limiting traffic that can reach open ports, closing ports that are not needed, stopping and disabling unused services, restricting sources, binding internal services to loopback or private addresses, and applying security updates.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How do I see which ports are listening before changing anything?
Inventory listeners first. On Linux, run:
ss -utlnThe options show listening TCP and UDP sockets without resolving names. To identify the owning process, use root privileges:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ss -utlnpRead the local-address column carefully. A listener on a loopback address is local-only; a wildcard address can accept traffic on every matching interface.
| Listener address | Meaning | Exposure decision |
|---|---|---|
127.0.0.1:PORT or ::1:PORT |
Loopback only | Not internet-facing; keep this binding for services used only by software on the same host. |
| A specific private or public IP | Bound to one interface or address | Reachability is limited to networks that can route to that address. |
0.0.0.0:PORT, [::]:PORT, or *:PORT |
Wildcard bind | Potentially exposed on every IPv4 or IPv6 interface; use only when that scope is intentional. |
Record the process, protocol, port, and bind address for every service you plan to expose. If a required service does not appear in ss, start or configure that service before changing firewall rules. If it appears only on loopback, change its service configuration or deliberately keep it private.
How should I decide which port and source networks to allow?
For each service, write down four values: protocol, port, bind address, and permitted source networks. A TCP rule does not permit UDP, and a rule for one port does not permit another. Restrict administrative services to known addresses or CIDR ranges whenever possible; do not use a broad source range merely because it is convenient.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
| Port category | Range or example | What to verify |
|---|---|---|
| Well-known | 0–1023 | Typical system services; confirm the actual daemon and protocol. |
| Registered/user | 1024–49151 | Common application and control-panel assignments; check the application’s documentation. |
| Dynamic/private | 49152–65535 | Often used for ephemeral connections, but an application can deliberately listen there. |
| Common conventions | SSH 22, HTTP 80, HTTPS 443 | Conventions only; inspect the listener and service configuration instead of assuming. |
Do not expose a wildcard bind for an internal database, cache, metrics endpoint, or administrative interface when a loopback or private-address bind is sufficient. A firewall rule narrows traffic, but reducing the listener’s bind scope removes an entire class of accidental exposure.
Recommended Free Tools
How do I open a port with UFW on Ubuntu?
UFW is Ubuntu’s standard frontend for netfilter/iptables. Check its current policy, permit your administration path, add the service rule, and then verify the result.
- Inspect the current state. Run
sudo ufw status verbose. If you are connected over SSH, keep the existing session open while making changes. - Allow SSH before enabling a restrictive policy. The basic rule is
sudo ufw allow 22/tcp; Ubuntu also provides the application profilesudo ufw allow OpenSSH. If administration should come only from a subnet, use a source restriction such assudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp, replacing the example network with your real administration range. - Allow the required application port. For example,
sudo ufw allow 80/tcppermits HTTP over TCP. Use the application’s actual port and protocol, not a conventional number chosen from memory. - Enable UFW only after the required access exists. Run
sudo ufw enableand confirm the prompt. Enabling a restrictive policy first can terminate your only management path. - Review and edit rules. Use
sudo ufw status numberedto see rule numbers. Remove a rule withsudo ufw delete allow 80/tcp, or delete by its displayed number withsudo ufw delete 3. Re-run status after each change.
UFW supports allow, deny, deletion, numbered status, source restrictions, and application profiles. Keep the rule set narrow: an allow rule for a service is not a reason to permit every source when the service has a known client network.
How do I allow a port with firewalld?
firewalld organizes rules into zones. You can allow a numeric port such as 80/tcp or a named service such as http. First identify the active zone, then add the rule in both the runtime and permanent configurations when it must survive reloads or reboots.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Find the active zone. Run
sudo firewall-cmd --get-active-zonesand note the zone attached to the server’s interface, commonlypublic. - Add a runtime rule while testing. For a numeric port, run
sudo firewall-cmd --zone=public --add-port=8080/tcp. For a defined service, runsudo firewall-cmd --zone=public --add-service=http. Substitute your active zone and the service’s actual protocol. - Make the rule persistent. Repeat the change with
--permanent, for examplesudo firewall-cmd --zone=public --permanent --add-port=8080/tcporsudo firewall-cmd --zone=public --permanent --add-service=http. - Reload and verify. Run
sudo firewall-cmd --reload, then inspectsudo firewall-cmd --zone=public --list-portsandsudo firewall-cmd --zone=public --list-services.
A runtime-only firewalld rule disappears after a service reload or reboot. The firewalld documentation notes that a permanent rule remains open after both a system reboot and a firewalld reload, but you still need to reload after adding the permanent configuration so the running firewall uses it.
What is the difference between UFW and firewalld?
Both manage the host firewall; choose the interface native to the distribution and the operational model your team already understands.
| Decision point | UFW | firewalld |
|---|---|---|
| Typical environment | Ubuntu’s default, simple rule-oriented commands | Zone-oriented distributions and workflows |
| Allow syntax | ufw allow 80/tcp or an application profile |
firewall-cmd --add-port=80/tcp or --add-service=http |
| Source scope | Direct source and CIDR syntax, such as allow from ... |
Zone assignment and zone rules; use the zone appropriate to the interface |
| Persistence concern | Rules are managed in UFW’s configuration and status output | Runtime and permanent rules are separate; permanent changes require reload |
| Recovery concern | Do not enable before allowing SSH | Do not reload or replace the active zone until the management path is permitted |
Do not run overlapping firewall managers casually. A rule shown by one tool may not explain a block imposed by another policy layer, so document which service owns the host firewall before troubleshooting.
How do I change the SSH port without locking myself out?
Open the new port first, change the SSH listener, reload the correct service, and test a second connection before removing the old rule. Keep an active session and ensure console or rescue access is available in case the new configuration fails.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Choose and document the new port. Confirm that no other service uses it and decide which source networks may connect.
- Permit the new port in the firewall. With UFW, use a rule such as
sudo ufw allow 2222/tcp. With firewalld, add both the runtime and permanent2222/tcprules to the active zone, then verify them. - Update the SSH listener. On traditional configurations, set the desired
Portin/etc/ssh/sshd_config. Ubuntu 24.04 and later may use the systemd unit/lib/systemd/system/ssh.socketwith aListenStreamsetting instead; inspect the active unit and use a systemd drop-in rather than assuming the traditional path. - Apply the systemd change when socket activation is in use. Run
sudo systemctl daemon-reload, thensudo systemctl restart ssh.socket. For a non-socket-activated setup, restart the SSH service using the service name used by that installation. - Confirm the listener locally. Run
sudo ss -utlnpand verify that the new port is listening on the intended address. - Test a second connection before closing the first. From another terminal, connect with
ssh -p 2222 user@server. Only after that succeeds should you remove the old firewall rule and, if desired, the old listener.
If the new connection fails, use the existing session or the provider’s console/rescue environment to restore the previous listener and firewall rule. Changing a port number alone is not a substitute for source restrictions, least-privilege accounts, key-based authentication, and timely security updates.
Why is a port open locally but unreachable from the internet?
Work from the listener outward. The failure is usually a mismatch between the service bind, protocol, firewall scope, or the address being tested.
- The process is not listening anymore. Re-run
sudo ss -utlnp; a crashed or stopped service cannot accept connections even if an old firewall rule remains. - The service is bound to loopback. A listener on
127.0.0.1or::1accepts local traffic only. Bind it to the specific private or public interface required by the design. - The protocol is wrong. Verify whether the application uses TCP, UDP, or both, and create rules for only the protocols it actually needs.
- The firewall rule targets the wrong port, zone, or source. Check UFW’s numbered status or firewalld’s active-zone lists. A source-restricted rule will reject clients outside its CIDR range.
- The firewalld rule was runtime-only. A reload or reboot removes it unless the same rule was added with
--permanentand then reloaded. - You are testing the wrong address family. Compare the client’s IPv4 or IPv6 destination with the listener shown by
ss; an IPv4 rule does not automatically create an IPv6 listener or policy. - The service advertises a different port. Treat the application configuration as authoritative rather than assuming that HTTP, HTTPS, or SSH uses its conventional number.
After each correction, test from a separate network or host, then repeat the local listener and firewall checks. Local success proves only that the process and local stack work; it does not prove that a remote path is permitted.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I close ports and reduce exposure after setup?
Remove services and rules together so that an old listener does not remain reachable and a stopped service does not leave confusing firewall entries.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- List listeners again with
sudo ss -utlnpand identify anything not required. - Stop and disable unused services using the service manager appropriate to the distribution.
- Delete the corresponding UFW rule with
ufw delete, or remove the firewalld port/service from both runtime and permanent configurations, then reload. - Bind internal applications to loopback or a private address instead of a wildcard address.
- Limit administrative rules to trusted source networks and apply available security updates.
- Reboot or reload during a maintenance window and repeat the listener, firewall, and remote-connectivity checks.
Keep a written inventory of every intentional listener, its owner, protocol, source range, and recovery procedure. That record makes later audits and incident response faster than relying on remembered commands.
What recovery plan should I have before changing firewall rules?
Assume that a syntax error, wrong zone, or missing SSH rule can cut off remote administration. Before enabling or reloading a restrictive policy, confirm at least one out-of-band path: a working console, rescue environment, or equivalent provider access.
- Keep one authenticated SSH session open while testing a second session.
- Record the previous listener and firewall rules so they can be restored exactly.
- Apply one change at a time and verify with
ssand the firewall’s status command. - If locked out, use console or rescue access to restore the old SSH listener, permit its port, and restart the affected socket or service.
This procedure is safer than changing the SSH port and firewall in one unverified step, especially on a production server where a reboot may remove temporary rules or expose a configuration error.
Frequently Asked Questions
Does changing the SSH port make a server secure?
No. A nonstandard port can reduce automated noise, but it does not replace key-based authentication, restricted source networks, least-privilege accounts, service updates, and a correctly scoped firewall. Treat the port number as an addressing choice, not a security control.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCan TCP and UDP use the same port number?
Yes. Firewall rules distinguish protocol as well as number, so TCP 53 and UDP 53 are separate allowances. Open only the protocol required by the application; permitting the other one does not help a client that is using the wrong transport.
Why does my firewall show an allow rule but no service is reachable?
An allow rule changes packet filtering, not application state. Check that a process is actively listening on that port and that it is bound to an address reachable from the client; a stopped service or loopback-only bind will still fail.
What should I document for every exposed port?
Record the owning service, TCP or UDP protocol, listener address, intended source CIDR ranges, firewall command, and how to disable it. Include whether the rule is persistent and the console or rescue method used to recover access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
