Search guides

Fix UFW that blocks a port

We'll confirm the port is blocked, add a ufw allow rule, reload, and verify—or tell you when to escalate.

Troubleshooting · Servers & Linux
10–15 min
What you'll need
  • SSH or console access to the Linux server
  • sudo on the server
  • The port number and protocol (TCP or UDP)
Step 1 of 5

Quick triage — pick your path

Quick triage — pick your path

Choose the option that matches what you see. You can jump straight to that section.

Show full guide

Steps

Goal: Confirm the port is blocked by UFW, add an allow rule, reload, and verify.

  • On the server: ss -tlnp to confirm the service listens. From another machine: nc -zv <server-ip> <port>.
  • Good: Service listens but connection times out—UFW may block. Proceed to Check ufw status.
  • Bad: Service does not listen—start the service first.

Check ufw status

Goal: Confirm UFW is active and see current rules.

  • Run sudo ufw status or sudo ufw status numbered.
  • Good: UFW is active. Proceed to Add allow rule.
  • Bad: UFW is inactive—check iptables or firewalld instead.

Add allow rule

Goal: Add an allow rule for the port and reload.

  • Run sudo ufw allow <port>/tcp (or /udp for UDP). Example: sudo ufw allow 8080/tcp.
  • Run sudo ufw reload.
  • Good: Rule added and firewall reloaded. Proceed to Confirm the rule.
  • Bad: Permission denied—see When to escalate.

Confirm the rule

Goal: Verify the rule is active and test the connection.

  • Run sudo ufw status numbered. The allow rule should appear.
  • From another machine: nc -zv <server-ip> <port> or curl http://<server-ip>:<port>.
  • Good: Connection succeeds. The port is open.
  • Bad: Still blocked—check rule order; a deny after allow overrides it.

When to escalate

Escalate if:

  • The server is managed by config management.
  • You cannot run ufw commands (permission denied).
  • Security policy forbids opening the port.

Provide ufw status output and the port you need.

Verification

  • sudo ufw status numbered shows an allow rule for the port.
  • nc -zv <server-ip> <port> from another machine succeeds.
  • The application can accept connections on the port.

Escalation ladder

Work from the device outward. Stop when the problem is fixed.

  1. Confirm port blocked Verify the service listens but connections from another machine fail.
  2. Check ufw status Run ufw status to see current rules.
  3. Add allow rule ufw allow <port>/tcp or /udp; ufw reload.
  4. Test connection nc -zv or curl from another machine.

What to capture if you need help

Before calling support or posting for help, have these ready. It speeds everything up.

  • ufw status numbered output
  • Port and protocol needed
  • Steps already tried

Does the service listen but connections from another machine fail?

Check ss -tlnp on server; nc -zv from client.

On the server: `ss -tlnp`. From client: `nc -zv <server-ip> <port>`. Service listens, client times out: UFW or network blocks. Service does not listen: fix the service first. Client connects: not a firewall issue.

Yes No

You can change your answer later.

Is UFW active?

Run sudo ufw status.

Run `sudo ufw status`. Active: add allow rule. Inactive: UFW is not the cause—check iptables or firewalld.

Yes No

You can change your answer later.

Add allow rule and reload

`sudo ufw allow <port>/tcp` (or /udp). `sudo ufw reload`. Test with nc -zv from client. Good: connection succeeds. Bad: check rule order with ufw status numbered.

Done

Fix the service

The service is not listening. Start it with systemctl or your init system. Check logs for why it failed.

Done

Check iptables or firewalld

UFW is inactive. Check `sudo iptables -L -n` or `sudo firewall-cmd --list-all`. See fix-iptables-blocks-traffic or fix-linux-firewall-blocks-port.

Done

Reviewed by Blackbox Atlas

Frequently asked questions

Why would UFW block a port?
UFW defaults to deny incoming. Unless you add an allow rule for the port, connections are blocked. Run ufw status to see current rules.
Can I fix UFW blocking a port myself?
Yes. Run sudo ufw allow <port>/tcp (or /udp), sudo ufw reload, then test with nc -zv or your application.
When should I escalate UFW blocking a port?
If the server is managed, you lack sudo for ufw commands, or security policy forbids opening the port.

Rate this guide

Was this helpful?

Continue to