ConfigManual
Networking

How to Open and Forward Ports in Linux Firewall (UFW & iptables)

Himanshu Pal

Himanshu Pal

How to Open and Forward Ports in Linux Firewall (UFW & iptables)

How to Open and Forward Ports in Linux Firewall (UFW, iptables, nftables)

Introduction

Firewalls control which traffic can reach your Linux server. Think of them as gatekeepers: open the right gates, keep the rest shut. Leaving unnecessary ports open is like leaving your house unlocked — it’s a common way attackers get in.

Why You Might Need to Open or Forward Ports

  • Hosting a website → open 80 (HTTP) and 443 (HTTPS)

  • Remote server access → open 22 (SSH)

  • VoIP or gaming → often need custom UDP/TCP port ranges

  • Reverse proxies or web apps → sometimes forward one external port to another service inside your network

This guide explains how to open and forward ports using Linux’s main firewall tools — UFW, iptables, and the newer nftables — along with testing and troubleshooting tips.

Firewalls, Ports, and Protocols

What is a Firewall?

A firewall filters network traffic according to rules you set. It decides which packets can enter or leave your system.

TCP vs UDP

  • TCP: connection-oriented, reliable (e.g. SSH, HTTP)

  • UDP: connectionless, faster for real-time traffic (e.g. DNS, VoIP, games)

Default Firewall Tools on Linux

  • UFW: easier interface for beginners (Ubuntu/Debian default)

  • iptables: older but still common and very granular

  • nftables: modern replacement for iptables, faster and cleaner syntax

Check currently open listening ports:

sudo ss -tulnp | grep LISTEN

Using UFW (Uncomplicated Firewall)

Install & Enable UFW

sudo apt update
sudo apt install ufw -y
sudo ufw allow 22/tcp        # allow SSH first so you don’t lock yourself out
sudo ufw enable
sudo ufw status verbose

Allow or Deny Ports

sudo ufw allow 80/tcp                 # HTTP
sudo ufw allow 443/tcp                # HTTPS
sudo ufw allow 53/udp                 # DNS over UDP
sudo ufw allow 10000:20000/udp        # RTP or custom range
sudo ufw deny 23                      # block Telnet

View numbered rules:

sudo ufw status numbered

Delete a rule:

sudo ufw delete <rule_number>

Tip: keep a second SSH session open while testing so you don’t lose access.

Advanced Control with iptables

View Current Rules

sudo iptables -L -n -v

Allow / Block Ports

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT        # allow SSH
sudo iptables -A INPUT -p tcp --dport 23 -j DROP          # block Telnet
sudo iptables -A INPUT -p tcp --dport 10000:20000 -j ACCEPT

Save Rules Permanently

Ubuntu/Debian:

sudo apt install iptables-persistent -y
sudo iptables-save | sudo tee /etc/iptables/rules.v4

CentOS/RHEL:

sudo service iptables save

Managing Rules with nftables (Modern Option)

Install & Enable

sudo apt install nftables -y
sudo systemctl enable --now nftables

Add Rules

sudo nft add rule inet filter input tcp dport 22 accept
sudo nft add rule inet filter input tcp dport 80 accept

Save Config

sudo nft list ruleset > /etc/nftables.conf
sudo systemctl reload nftables

Port Forwarding

With UFW

Edit /etc/ufw/before.rules and add before COMMIT:

*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 80
COMMIT

Reload:

sudo ufw reload

With iptables

Forward external 8080 → 80 on the same host:

sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 80

Forward to another host:

sudo iptables -t nat -A PREROUTING -p tcp --dport 2222 \
    -j DNAT --to-destination 192.168.1.50:22
sudo iptables -A FORWARD -p tcp -d 192.168.1.50 --dport 22 -j ACCEPT

With nftables

sudo nft add rule ip nat prerouting tcp dport 8080 redirect to 80

Testing Open / Forwarded Ports

On a remote client:

nc -zv <server_ip> 22
telnet <server_ip> 80
nmap -p 22,80,443 <server_ip>

On the server:

sudo ss -tuln

You can also use online checkers such as canyouseeme.org to confirm external accessibility.

Common Pitfalls & Fixes

  • Always allow SSH before enabling firewall to avoid locking yourself out.

  • Check cloud firewall or security group settings (AWS, GCP, Azure) if rules don’t work.

  • Persist iptables/nftables rules or they’ll reset after reboot.

  • Don’t mix different firewall tools (UFW, raw iptables, firewalld) on the same system — it causes conflicts.

Best Practices

  • Open only the ports you absolutely need.

  • Pair firewall rules with tools like fail2ban to block brute-force login attempts.

  • Restrict sensitive ports to known IPs:

sudo ufw allow from 203.0.113.5 to any port 22

  • Prefer nftables on newer systems for cleaner syntax and better performance.

  • Test in a staging VM or lab setup before applying to production.

Conclusion

You now have a clear set of steps to:

  • Understand Linux firewalls and port protocols

  • Open and manage ports with UFW, iptables, or nftables

  • Set up and test port forwarding safely

  • Follow best practices to keep your server secure

🟢 Bonus Hands-On Challenge

Open 8080 with UFW:

sudo ufw allow 8080

Forward 8080 → 80 in /etc/ufw/before.rules, reload UFW, then test:

sudo ufw reload
curl http://localhost:8080
Linux FirewallUFWiptablesnftablesPort ForwardingNetworkingTCPUDPSIPRTPCLISecurityVoIPNmapfail2ban