How to Open Port on Linux VPS?

Opening a port on a Linux VPS allows external devices and services to establish connections to applications running on your server. The ways to open a port on a Linux VPS differ depending on your Linux distribution; some Linux distributions use different firewall systems to control incoming and outgoing traffic.

If you are on an Ubuntu VPS, Ubuntu commonly uses UFW, while other distributions may use Firewalld or nftables. You can also manage firewall rules directly using iptables and nftables, but these are lower-level tools that are generally more complex to work with.

In this guide, we will focus on practical ways to check listening ports and open ports using the most common Linux firewall methods. We’ll cover basic commands for each method that can be useful and practical.

Check Open and Listening Ports on Linux

To start opening ports on Linux, first you need to list the listening ports and open ports to verify that the desired port isn’t already open. You can use the ss command to check which ports are currently listening on your Linux VPS. Run the following command to list all listening TCP and UDP ports:

sudo ss -tuln

Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process
udp    UNCONN  0       0           127.0.0.54:53          0.0.0.0:*
udp    UNCONN  0       0        127.0.0.53%lo:53          0.0.0.0:*
tcp    LISTEN  0       511          127.0.0.1:6379        0.0.0.0:*
tcp    LISTEN  0       4096           0.0.0.0:4587        0.0.0.0:*

For a more detailed explanation and other methods for checking open ports on a Linux VPS, you can follow our dedicated guide, which explains more methods and tools:

READ How to Check Open Ports List in Linux

Check Which Firewall Is Running on Linux Server

There is no universal command to identify which firewall is running on a Linux server. However, you can use the following commands to check the status of the most common firewall tools and determine whether they are installed and active on your server.

Check UFW Status

Run the command below to check UFW status. If UFW is installed and active, you’ll see Status: active. If installed but not running, you’ll see Status : inactive.

sudo ufw status

If you get the ufw: command not found ” error, it means you don’t have ufw installed on your Linux server. You can use the following guide to install it on your Ubuntu VPS server:

ReadHow to Setup UFW on Ubuntu?

Learn how to set up UFW on Ubuntu, including installation, SSH configuration, default policies, firewall activation, logging, and verification.

Read the full article

Check Firewalld Status on Linux

To check whether firewalld is installed and active, run the command below:

sudo firewall-cmd --state

You will get outputs like this :

• Running
• not running
• not installed = command not found

Check iptables status on Linux

This displays the current IPv4 firewall rules. However, iptables can be available even when it’s not actively managing the firewall, so this command alone doesn’t confirm that it’s the primary firewall manager.

sudo iptables -L -n -v

Check nftables Status on Linux

Run the command below to check nftables status:

sudo nft list ruleset

If nftables has configured rules, you’ll see output similar to this, otherwide the command may return not output.

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        tcp dport 22 accept
        tcp dport 8080 accept
    }
}

Open a Port Using UFW

UFW (Uncomplicated Firewall) is a simple firewall management tool commonly used on Ubuntu. It allows you to manage firewall rules using straightforward commands. Below are examples of how to open ports using UFW. For more detailed instructions, see our dedicated guide:

ReadHow to Open a Port or IP With UFW in Ubuntu?

Learn how to open ports and allow specific IP addresses or subnets with UFW on Ubuntu, Debian, and other Linux distributions.

Read the full article

Open Specific TCP Port With UFW

To allow incoming connection thourgh TCP protocol you can use the command below to open the specified port in UFW. Replace 8080 with your desired port.

sudo ufw allow 8080/tcp

Rules updated

Open Specific UDP Port With UFW

To allow a UDP port through the UFW firewall, you just need to replace /tcp, which we used in the previous command, with /udp and run the command.

sudo ufw allow 8080/udp

Open a Port Using Firewalld

Some Linux distributions like AlmaLinux, Rocky Linux, CentOS, and Fedora mostly use Firewalld. It uses easy commands too and manages firewall rules through predefined zones and services. In firewalld, you can use the name of a predefined service to open all connections related to it, or you can use a port directly.

Allow connection to a specific port with firewalld

To allow a connection to a specific port in firwalld you can use the command below; replace the 8080 and /tcp with your desired port and protocol to apply the rule.

sudo firewall-cmd --permanent --add-port=8080/tcp

Allow connections using a predefined service

With Firewalld, you can use predefined service names instead of specifying individual ports. For example, rather than opening port 80 manually, you can allow HTTP traffic by adding the http service.

The command below adds firewalld rules to allow http and https connections.

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

To open any service, you can replace the http with your desired service name and run the command. If you want a list of all predefined services in firewalld, you can run the command below to list the firewalld services directory:

ls /usr/lib/firewalld/services/

Reload Firewalld

After adding any rule, make sure to reload firewalld to apply permanent changes:

sudo firewall-cmd --reload

To check the currently allowed ports and services, use:

sudo firewall-cmd --list-all

Open a Port Using iptables (advanced)

iptables is a lower-level Linux firewall management tool that allows you to control network traffic by defining packet-filtering rules. Unlike UFW and Firewalld, it requires more knowledge of firewall rules and network protocols.

Allow TCP connections to Linux VPS with iptables

To allow incoming TCP connections to your desired port, run the following command; you can use it with other ports by replacing the 8080 with your desired port.

sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

Allow UDP connections using iptables

To allow UDP ports, you can replace the tcp with udp like the example below:

sudo iptables -A INPUT -p udp --dport 8080 -j ACCEPT

Check iptables existing rules in Linux

To check the current rules in iptables, run the following command:

sudo iptables -L INPUT -n -v

Open a Port Using nftables

nftables is the modern Linux firewall framework designed to replace iptables. It provides more flexible packet filtering and firewall rule management, but the syntax and configuration can be more complex than UFW and Firewalld.

Open Port with nftables in Linux VPS

To allow incoming TCP connections on port 8080 run the following command; instead of the port 8080 you can replace any port you want to open.

sudo nft add rule inet filter input tcp dport 8080 accept

To open UDP port you can replace the tcp in the command above with udp and run it for your desired UDP port.

sudo nft add rule inet filter input udp dport 8080 accept

In these commands, inet specifies the address family for both IPv4 and IPv6, filter is the table name, and input is the chain that handles incoming traffic. the dport option specifies the destination port, while accept allows matching traffic.

View Existing nftables Rules

To view and verify existing nftables rules, run the following command:

sudo nft list ruleset

Make nftables Rules Persistent

To keep your rules across reboots, you need to save the current ruleset to the nftables configuration file, usually located at /etc/nftables.conf.

To save the current rules, run:

sudo nft list ruleset | sudo tee /etc/nftables.conf

Next, you can enable the nftables service so it loads the saved configuration when the server reboots:

sudo systemctl enable nftables

You can also start the service immediately using:

sudo systemctl start nftables

Once configured, nftables will load the saved ruleset during system startup, keeping your firewall rules active after reboots.

Conclusion

To open a port on a Linux server, you first need to identify which firewall is being used by your Linux distribution. Ubuntu commonly uses UFW, while distributions such as AlmaLinux, Rocky Linux, and Fedora typically use Firewalld. However, you can also install and use alternative firewall management tools.

UFW and Firewalld are relatively easy to use and manage, making them suitable for most users. Alternatively, you can use lower-level tools such as iptables and nftables, which offer more control over firewall rules but require a better understanding of networking protocols and Linux firewall configurations.

Keep in mind that these tools are not limited to specific Linux distributions. You can use different firewall management tools on most Linux distributions, provided they are supported and properly configured.

FAQ