> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Firewall Ports

> Explains firewalls, common ports, and basic UFW and FirewallD commands plus tools to inspect listening sockets and secure remote access

So what's a firewall?

A firewall is a security barrier—either software or hardware—that sits between your systems and the network (including the internet) and enforces policies about which traffic is allowed or denied. It inspects, monitors, and controls network traffic entering and leaving a host or network according to configured rules.

![A diagram showing a desktop computer inside a dashed boundary with a brick-and-shield firewall icon between it and a Wi‑Fi router. The caption says the firewall "acts like a barrier between the system and the internet."](https://mintcdn.com/kodekloud-c4ac6d9a/ij3FNIPjp1w0Myd0/images/Nginx-for-Beginners/Install-Config/Firewall-Ports/firewall-barrier-desktop-router-diagram.jpg?fit=max\&auto=format\&n=ij3FNIPjp1w0Myd0\&q=85\&s=9422095bbb8e10ca07ca19e2aeecb010)

Think of a firewall like a home security system that watches doors and windows: keep most entry points closed and open only what you need. Firewalls come in two common forms:

* Host-based software firewalls (typical for desktops and individual servers).
* Dedicated hardware appliances (common in enterprise and datacenter networks).

Debian- and Ubuntu-based distributions commonly use UFW (Uncomplicated Firewall) to configure host firewall rules. UFW is a simpler front end to the kernel-level packet filters (historically iptables; many modern systems use nftables underneath). By default UFW is disabled, so enabling and tightening it is a basic hardening step—allowing only required traffic.

![The image shows a "Firewall" screen with the Debian and Ubuntu logos side by side. Below them is a button labeled "Uncomplicated Firewall (UFW)" and a note stating the firewall is off by default but can be enabled.](https://mintcdn.com/kodekloud-c4ac6d9a/ij3FNIPjp1w0Myd0/images/Nginx-for-Beginners/Install-Config/Firewall-Ports/debian-ubuntu-ufw-firewall-off.jpg?fit=max\&auto=format\&n=ij3FNIPjp1w0Myd0\&q=85\&s=4ac25c6e6da685de91a49a5de40fbe44)

Red Hat family distributions (RHEL, CentOS, Fedora) typically use FirewallD as the management tool. FirewallD also sits on top of the kernel packet filtering stack (iptables/nftables). If FirewallD is not already installed, you can add it through your package manager.

![A slide titled "Firewall" showing the Red Hat and Fedora logos side by side, with notes below saying to install via YUM if needed and that iptables comes pre-installed in all Linux distros.](https://mintcdn.com/kodekloud-c4ac6d9a/ij3FNIPjp1w0Myd0/images/Nginx-for-Beginners/Install-Config/Firewall-Ports/firewall-redhat-fedora-yum-iptables.jpg?fit=max\&auto=format\&n=ij3FNIPjp1w0Myd0\&q=85\&s=10ec30999d7bbf05db28a28e834c6d43)

Host firewalls are also available on Windows and macOS. Windows Firewall is usually enabled by default; on macOS you can enable the firewall in System Settings. Regardless of platform, enabling a host firewall and restricting unnecessary ports is a fundamental security practice.

Ports — what are they?

A port is a network communication endpoint used by services to send and receive data. If a computer is a house, ports are the doors or windows: keep most closed and open only the ones needed.

When you browse HTTPS websites, your browser typically connects to port 443. SSH commonly uses port 22, RDP uses port 3389, and so on. You don't need to memorize every port—focus on the ones you use.

![A presentation slide titled "Common Ports" listing network services with their default port numbers (e.g., HTTP 80, HTTPS 443, SMTP 25, SSH 22, MySQL 3306, RDP 3389, FTP 21, DNS 53, PostgreSQL 5432, Redis 6379, Kubernetes API 6443).](https://mintcdn.com/kodekloud-c4ac6d9a/ij3FNIPjp1w0Myd0/images/Nginx-for-Beginners/Install-Config/Firewall-Ports/common-ports-network-services.jpg?fit=max\&auto=format\&n=ij3FNIPjp1w0Myd0\&q=85\&s=c826cd5dd8252f2d5e0dc8aa8c31a27e)

Quick reference table — common ports to know:

| Service | Port | Use |
| -: | :-: | - |
| HTTP | `80` | Unencrypted web traffic |
| HTTPS | `443` | Encrypted web traffic (TLS/SSL) |
| SSH | `22` | Secure shell remote access |
| RDP | `3389` | Remote Desktop (Windows) |
| MySQL | `3306` | MySQL database |
| PostgreSQL | `5432` | PostgreSQL database |
| Redis | `6379` | Redis key-value store |
| DNS | `53` | Domain name resolution |
| FTP | `21` | File Transfer Protocol |
| Kubernetes API | `6443` | Kubernetes control plane API |

To host a website to the public, you generally need only HTTP (`80`) and HTTPS (`443`) open. If you must open other ports, reduce risk by:

* Restricting access by client IP (whitelisting).
* Placing services behind a VPN, reverse proxy, or load balancer.
* Using a Web Application Firewall (WAF) to block malicious requests and allow legitimate traffic.

![A simple diagram showing multiple client computers (two with green checkmarks and one with a malicious/hacker icon) sending requests through a Web Application Firewall (illustrated as a flaming brick wall) to reach origin servers. The WAF blocks the malicious request (red X) while allowing the legitimate ones.](https://mintcdn.com/kodekloud-c4ac6d9a/ij3FNIPjp1w0Myd0/images/Nginx-for-Beginners/Install-Config/Firewall-Ports/waf-blocks-malicious-allows-legit-clients.jpg?fit=max\&auto=format\&n=ij3FNIPjp1w0Myd0\&q=85\&s=64daff6b24bf7f66f15bf7c098a72b8b)

Important: always open your remote access port before enabling a firewall on a remote server—otherwise you may lock yourself out.

Before enabling a firewall on a remote system, ensure your remote access port (for example SSH on port 22) is allowed. If you enable the firewall without allowing your remote access, you could lose remote access to the machine.

UFW (Debian/Ubuntu) — basic commands

Run these on Debian/Ubuntu-based systems to allow the most common access and enable the firewall. Always allow remote access first on remote machines.

* Allow SSH (important to run first on remote servers):

```bash theme={null}
sudo ufw allow 22/tcp
```

* Allow HTTP and HTTPS:

```bash theme={null}
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```

* Enable the firewall:

```bash theme={null}
sudo ufw enable
```

* Check status (human-readable):

```bash theme={null}
sudo ufw status verbose
```

* Show rules with numbering (useful for deleting a rule):

```bash theme={null}
sudo ufw status numbered
```

* Delete a rule by its number (example deleting rule number 3):

```bash theme={null}
sudo ufw delete 3
```

Tip: you can also delete a rule by specifying it, for example:

```bash theme={null}
sudo ufw delete allow 22/tcp
```

FirewallD (RHEL/CentOS/Fedora) — basic commands

Install, start, and enable FirewallD:

```bash theme={null}
sudo yum update && sudo yum install -y firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld
```

(On newer Fedora/RHEL systems, use `dnf` instead of `yum`.)

Open a port permanently (example: open port 443/tcp) and reload:

```bash theme={null}
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload
```

Remove a permanent port and reload:

```bash theme={null}
sudo firewall-cmd --permanent --remove-port=443/tcp
sudo firewall-cmd --reload
```

Query runtime or permanent rules and the default zone:

```bash theme={null}
sudo firewall-cmd --list-all
# or for a specific zone:
sudo firewall-cmd --zone=public --list-ports
```

Combined quick example for FirewallD:

```bash theme={null}
# Install and enable FirewallD
sudo yum update && sudo yum install -y firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld

# Open HTTP and HTTPS permanently, then reload
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

# Remove HTTP and reload
sudo firewall-cmd --permanent --remove-port=80/tcp
sudo firewall-cmd --reload
```

Inspecting listening ports and connections

Firewalls control what traffic can get to your host, but you also need to know which services are actually listening on which ports. Tools to inspect sockets:

* ss (modern, recommended): `ss -tulnp` shows TCP/UDP listening sockets with process info.
* netstat (older, from net-tools): `sudo netstat -nltup` shows listening sockets and owning processes.

Install net-tools if needed:

```bash theme={null}
# Debian/Ubuntu
sudo apt update && sudo apt install -y net-tools

# RHEL/CentOS/Fedora
sudo yum install -y net-tools
```

Common netstat usage:

```bash theme={null}
sudo netstat -nltup
```

Flags explained:

* `-n` — show numeric addresses (no DNS lookups)
* `-l` — show listening sockets
* `-t` — TCP
* `-u` — UDP
* `-p` — show PID/program name

Remember: a firewall may permit a port, but if no service is listening that port is effectively closed. Conversely, a service can be listening but unreachable because a firewall blocks it. When troubleshooting connectivity, combine checks:

* Firewall rules: `sudo ufw status`, `sudo firewall-cmd --list-all`
* Socket/listener status: `ss -tulnp` or `sudo netstat -nltup`

Practice these commands on a test machine before applying them to production systems.

Further reading and references

* UFW documentation: [https://manpages.ubuntu.com/manpages/focal/man8/ufw.8.html](https://manpages.ubuntu.com/manpages/focal/man8/ufw.8.html)
* FirewallD documentation: [https://firewalld.org/documentation/](https://firewalld.org/documentation/)
* iptables vs nftables overview: [https://wiki.nftables.org/](https://wiki.nftables.org/)
* ss (iproute2) manual: [https://man7.org/linux/man-pages/man8/ss.8.html](https://man7.org/linux/man-pages/man8/ss.8.html)
* netstat (net-tools) manual: [https://man7.org/linux/man-pages/man8/netstat.8.html](https://man7.org/linux/man-pages/man8/netstat.8.html)

Now that you understand firewalls, ports, and the common inspection tools, try these commands in a safe test environment to reinforce the concepts.

> **[Watch Video](https://learn.kodekloud.com/user/courses/nginx-for-beginners/module/0de43784-b08d-4ce0-8470-a7541b78fe58/lesson/4ff8592e-fd7b-4f7f-9a35-39994c529479)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.