Why is my Linux firewall blocking a port?

What this covers

A firewalled port is deceptive, because the service itself looks perfectly healthy: it starts, localhost works, logs show nothing wrong. The trick is to walk the path the traffic actually takes — client, listener, then firewall rules — instead of guessing at the firewall. This guide keeps that order, uses firewalld commands for RPM-based distros and ufw for Debian-based ones, and ends with proof from outside the host.

Symptom

Confirm the service is actually listening

Before touching the firewall, check that the app is bound to the port at all. If the port does not appear in the listening sockets, or the process is bound only to 127.0.0.1 instead of 0.0.0.0, no firewall change will help — the problem is the service or its bind address. Note the owning process name and PID so you know you are looking at the right daemon, and whether it is bound to all interfaces or just loopback.

$ sudo ss -tulpn

Probe the port from another machine

Run netcat in scan mode from a host outside the server; it opens exactly one TCP connection and prints the result. Three outcomes mean three different things: 'succeeded' means the path and the firewall are fine and the problem is elsewhere; 'connection refused' means the packet reached the host but nothing was listening on that port; a hang that ends in a timeout is the classic signature of a packet filter silently dropping the traffic. Only that last case points at the firewall.

$ nc -zv example.com 443

Inspect the firewalld ruleset

This dumps the active zone's services, open ports and rich rules in one go — the firewalld equivalent of reading the whole ruleset. If the port you need is neither in the ports list nor covered by a service or rich rule, the firewall is dropping it. Also note which zone is active and which zone the interface belongs to, because a rule added to the wrong zone will never match the inbound traffic.

$ sudo firewall-cmd --list-all

Check whether packets reach the host at all

Only needed if the netcat probe timed out and you want proof. Capture on any interface with a filter for the port while a client retries. If you see repeated SYNs and no reply from the server, something on the host is dropping them — almost always the firewall. If you see a SYN answered with a RST, the packet got through and was actively refused, so the service or its bind address is the culprit, not the firewall.

$ sudo tcpdump -i any -nn port 443

Open the port permanently in firewalld

Use this on Fedora, RHEL and CentOS hosts. The permanent flag writes the rule into the stored configuration and the reload applies it right away, so the port stays open across reboots — a temporary rule would silently disappear next boot. Match the protocol to the service (TCP for HTTP-style apps, UDP for game and DNS-style traffic). Afterwards the port should show up in the allowed ports of the active zone.

$ sudo firewall-cmd --permanent --add-port=8080/tcp && sudo firewall-cmd --reload

$ sudo firewall-cmd --permanent --remove-port=8080/tcp && sudo firewall-cmd --reload

On Ubuntu or Debian, add the rule with ufw

If the host runs ufw instead of firewalld, the firewalld command has no effect and this is the correct fix. Add a rule for the port and protocol you need; the delete form removes it again. Order matters when you are still setting the host up: allow your SSH port before you enable ufw, otherwise enabling the firewall cuts your own remote session immediately.

$ sudo ufw allow 22/tcp

$ sudo ufw delete allow 22/tcp

Verify from outside with a port scan

Run the scan from a host outside the server, not from the server itself — a scan from localhost bypasses most filtering and proves nothing. The port should now appear open and report the expected service version, which confirms the rule is live for remote traffic. If it is still closed, re-check that the rule landed in the zone that owns the inbound interface, and that the permanent change was actually reloaded.

$ nmap -sV -p- 192.168.1.10

How to confirm it worked

From an outside host, a netcat probe succeeds and a port scan shows the port open with the expected service banner. On the server, the port now appears among the allowed ports of the active firewall zone.

Undo everything

Every command above can be reverted. Run these in order to undo all of it.

$ sudo ufw delete allow 22/tcp
sudo firewall-cmd --permanent --remove-port=8080/tcp && sudo firewall-cmd --reload

Review before running — some steps may not be independent.

Sources

• nc(1) — arbitrary TCP and UDP connections and listens (OpenBSD netcat)
  Ubuntu Manpages · technical · 2026-09-17
  Evidence: Documents -z (zero-I/O scan mode) and -v (verbose) for testing if a port is open without sending data
• OpenSSL — ArchWiki
  ArchWiki · community · 2026-09-17
  Evidence: ArchWiki network troubleshooting pages commonly recommend nc -zv for quick port reachability checks
• firewall-cmd(1) — firewalld command line client
  Ubuntu manpages · technical · 2026-09-17
  Evidence: Documents --list-all showing zone configuration including ports, services, and rich rules.
• Firewalld — ArchWiki
  ArchWiki · community · 2026-09-17
  Evidence: Community guide on querying firewalld state and permanently adding rules with --permanent plus --reload.
• tcpdump(1) — dump traffic on a network
  tcpdump.org · vendor-doc · 2026-09-17
  Evidence: Documents -i any (all interfaces), -n (no name resolution), and BPF filter expressions like `port 443`.
• firewall-cmd(1) — Ubuntu manual page
  Canonical · community · 2026-09-17
  Evidence: Reference for firewall-cmd port options and runtime vs permanent configuration behavior.
• firewall-cmd(1) — official man page
  firewalld project · vendor-doc · 2026-09-17
  Evidence: Documents --add-port, --permanent, and --reload for opening ports in firewalld zones.
• ss(8) — another utility to investigate sockets
  man7.org · technical · 2026-09-17
  Evidence: The ss man page documents -t (TCP), -u (UDP), -l (listening), -p (show process), and -n (numeric ports/addresses).

Last verified: 2026-09-22

Related guides