Open ports with UFW: single ports, ranges and trusted IPs

UFW (Uncomplicated Firewall) is the standard firewall front end on Ubuntu and Debian. This guide shows the exact ufw allow syntax for single ports, port ranges and trusted IP addresses, so you open only what your server needs and nothing more. Each rule you add is one more door into the server, so keep the list short and labelled.

Before you start

• A Linux VPS running Ubuntu 22.04, Ubuntu 24.04 or Debian 12, with UFW installed. If it is not set up yet, start with Set up the UFW firewall on Ubuntu and Debian.
• A user with sudo rights, connected over SSH.
• Your SSH port. It is 22 unless you changed it.

Allow SSH first, then check the current state:

sudo ufw allow 22/tcp
sudo ufw status verbose

If you moved SSH to another port, use that number instead of 22.

Open a single port

The basic form is ufw allow <port>/<protocol>:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 51820/udp

Always name the protocol. If you write sudo ufw allow 80 with no protocol, UFW opens the port for both TCP and UDP. That works, but it opens more than a web server needs.

UFW also knows some services by name from /etc/services, so sudo ufw allow https is the same as allowing 443. Packages can ship application profiles too. List them with:

sudo ufw app list

On a server with Nginx installed you will usually see Nginx Full, Nginx HTTP and Nginx HTTPS. Allow one with quotes because the name has a space:

sudo ufw allow 'Nginx Full'

Open a port range

Ranges use a colon between the first and last port, and a protocol is required:

sudo ufw allow 6000:6010/tcp
sudo ufw allow 60000:61000/udp

The second line is the range that mosh uses, for example. Without /tcp or /udp, UFW rejects a range with an error.

To open several separate ports in one rule, list them with commas. This also needs a protocol:

sudo ufw allow proto tcp from any to any port 80,443,8080

Allow a port only from a trusted IP or subnet

This is the most useful rule for admin ports such as SSH, database ports or a control panel. Only the address you name can connect.

Allow everything from one IP:

sudo ufw allow from 203.0.113.10

Allow one port from one IP:

sudo ufw allow from 203.0.113.10 to any port 22 proto tcp

Allow a database port from a whole office subnet:

sudo ufw allow from 198.51.100.0/24 to any port 3306 proto tcp

The /24 is CIDR notation for 256 addresses. If that is new to you, read CIDR notation and subnets explained.

To replace a public SSH rule with a trusted-IP rule, add the new rule first, test a fresh SSH login from that IP, then delete the old public rule. Never remove the public rule first.

Label rules with comments

Add comment to the end of any rule so you remember later why it exists:

sudo ufw allow 443/tcp comment 'HTTPS for Nginx'
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp comment 'SSH from office'

Comments show up in ufw status output. They cost nothing and make clean-ups much safer.

Check it works

List the rules with their numbers:

sudo ufw status numbered

Example output:

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 443/tcp                    ALLOW IN    Anywhere                   # HTTPS for Nginx
[ 3] 3306/tcp                   ALLOW IN    198.51.100.0/24
[ 4] 22/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 5] 443/tcp (v6)               ALLOW IN    Anywhere (v6)              # HTTPS for Nginx

Rules marked (v6) are the IPv6 copies that UFW creates for you. Then test from another computer, not from the server itself:

nc -vz 203.0.113.10 443

A succeeded or open result means the port is reachable. A firewall rule only lets traffic through. A service still has to be listening on that port, which you can check with sudo ss -tulpn.

Troubleshooting

• "ERROR: Must specify 'tcp' or 'udp' with multiple ports": ranges and comma lists need a protocol. Add /tcp, /udp or proto tcp.
• Rule added but the port is still closed: the service may only listen on 127.0.0.1, or UFW may be inactive. Run sudo ufw status and sudo ss -tulpn. See Port open in the firewall but still unreachable.
• "Skipping adding existing rule": the rule is already there. Nothing needs to change.
• A trusted-IP rule does not match: you may be connecting over IPv6, or through a VPN with a different exit IP. Check your current address and add the right one.
• Locked out after enabling UFW: use the browser console in your VPS provider's control panel, run sudo ufw allow 22/tcp, then reconnect.

Next steps

• Clean up rules you no longer need: Delete, insert and reorder UFW rules safely.
• Slow down password guessing on SSH: Rate-limit SSH and other ports with ufw limit.
• Block abusive addresses: Block an IP address or subnet with UFW.