ufw allow 22/tcp: open a port with ufw
- tool
- ufw
- versions
- ufw 0.36
- os
- linux
sudo ufw allow 22/tcp adds a rule that accepts incoming TCP connections on port 22. Use a service name from /etc/services (sudo ufw allow ssh) or an application profile (sudo ufw allow 'Nginx Full'). Rules take effect immediately when ufw is active; check them with sudo ufw status numbered. Allow SSH before running sudo ufw enable on a remote server, or you lock yourself out.
Open ports
sudo ufw allow 22/tcp # one port, TCP only
sudo ufw allow 80,443/tcp # several ports
sudo ufw allow 6000:6007/tcp # a range (the protocol is required)
sudo ufw allow from 203.0.113.0/24 to any port 5432 proto tcp # only from one network
sudo ufw allow in on eth1 to any port 3306 # only on one interface
sudo ufw limit ssh # allow, but rate-limit repeated connectionsHow the rule syntax reads
| Form | Meaning |
|---|---|
| ufw allow 443 | Port 443 over TCP and UDP, from anywhere, to any local address. |
| ufw allow 443/tcp | Port 443 over TCP only. |
| ufw allow http | Port by service name from /etc/services (http is 80/tcp). |
| ufw allow from ADDR to any port N proto tcp | Full syntax: source address or network, destination and protocol. |
| ufw allow in on IFACE to any port N | Only for traffic arriving on one interface. |
| ufw insert 1 deny from ADDR | Put a rule first; ufw checks rules in order and the first match wins. |
| ufw route allow ... | Rules for forwarded traffic (routers, VPN gateways), separate from incoming rules. |
Because the first matching rule wins, a broad allow 22/tcp placed above a later deny from 198.51.100.7 lets that address in. Use ufw insert for exceptions. Forwarded traffic is governed by the default forward policy, not by ufw allow.
Enable and check
sudo ufw allow OpenSSH # first, on a remote machine
sudo ufw enable
sudo ufw status verbose # default policies and rules
sudo ufw status numbered # rules with numbers, for deletingThe default policy after ufw enable is to deny incoming and allow outgoing connections.
Remove a rule
sudo ufw delete allow 80/tcp # by repeating the rule
sudo ufw status numbered
sudo ufw delete 3 # by numberApplication profiles
Packages such as OpenSSH, nginx and Apache install profiles in /etc/ufw/applications.d/:
sudo ufw app list
sudo ufw app info 'Nginx Full'
sudo ufw allow 'Nginx Full'Errors you may see
ERROR: You need to be root to run this script: run the command withsudo; see that error.ERROR: Could not find a profile matching 'Nginx Full': the profile name is wrong or the package that ships it is not installed; checkufw app listand see that error.- The rule is listed but the port still does not answer: confirm the service listens on a public address with ss -tulpn.
| Command | Effect |
|---|---|
| ufw allow PORT[/PROTO] | Accept incoming traffic to the port |
| ufw deny PORT | Drop incoming traffic silently |
| ufw reject PORT | Refuse it and send an error back to the client |
| ufw limit PORT | Deny an address after 6 or more connections in 30 seconds |
| ufw default deny incoming | Set the default policy |
| ufw reload / ufw disable | Reload rules / turn the firewall off |
FAQ
Does ufw allow 80 open TCP and UDP?
Yes. Without /tcp or /udp the rule matches both protocols. Add the protocol when the service uses only one of them, which keeps the rule narrower.
Can I add rules before enabling ufw?
Yes. Rules added while ufw is inactive are saved and applied when you run ufw enable. That is the safe order on a remote server: allow SSH first, then enable.
Does the rule also cover IPv6?
When IPV6=yes is set in /etc/default/ufw (the default on Ubuntu), ufw adds the matching IPv6 rule automatically; ufw status lists it with (v6).