How to open a port on your server

To connect to a port, two things must be true: a program must be listening on it, and the firewall must let connections through. If something won’t open, check both.

Which firewall you are running

Our images ship with the firewall switched off: on Ubuntu, ufw is installed but disabled; Debian and AlmaLinux don’t have one; FreeBSD has pf, disabled. To see what is running now:

sudo ufw status               # Ubuntu, Debian
sudo firewall-cmd --state      # AlmaLinux
sudo nft list ruleset          # all rules in the kernel, if nftables is installed

Pick just one: ufw and firewalld are both front ends for nftables, and they get in each other’s way if you use them together.

ufw — Ubuntu and Debian

sudo ufw allow 22/tcp          # SSH — first of all
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status numbered

On Debian, install it first: sudo apt install ufw. Rules are saved automatically and survive a reboot.

firewalld — AlmaLinux

To install firewalld, see the AlmaLinux guide. SSH is allowed in it from the start.

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Without --permanent a rule lasts only until the next reboot or --reload — handy for trying something out. For well-known services you can use a name instead of a number: --add-service=http, https, mysql. To close a port, use --remove-port=8080/tcp.

To let only one address reach a port:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.7" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

nftables — with no front end

You can also write rules directly in nftables. On Debian, install it first: sudo apt install nftables. The file is /etc/nftables.conf on Ubuntu and Debian, and /etc/sysconfig/nftables.conf on AlmaLinux. In this example, incoming connections are blocked except SSH, web traffic, ping and replies to connections the server itself started:

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    meta l4proto { icmp, ipv6-icmp } accept
    tcp dport { 22, 80, 443 } accept
  }
}

Check the file, then enable it:

sudo nft -c -f /etc/nftables.conf
sudo systemctl enable --now nftables

flush ruleset erases all rules, including those created by Docker and fail2ban. After restarting nftables, restart them too.

iptables

On current systems iptables is also a wrapper around nftables, so the old commands and scripts still work:

sudo iptables -I INPUT -p tcp --dport 8080 -j ACCEPT    # open a port
sudo iptables -L INPUT -n --line-numbers               # rules with numbers
sudo iptables -D INPUT 1                               # delete a rule by number

iptables rules last only until a reboot. To save them on Ubuntu and Debian, run sudo apt install iptables-persistent, then sudo netfilter-persistent save after every change.

FreeBSD

On FreeBSD the firewall is pf. For an example ruleset and how to enable it, see the FreeBSD guide.

The port is open but you can’t connect

1. Is the program listening on the port? sudo ss -ltnp | grep 8080. An address of 127.0.0.1:8080 means the program accepts connections only from inside the server — change the address in its settings to 0.0.0.0 (for MySQL this is bind-address). If there is no line at all, the program isn’t running or is listening on a different port.
2. Is the firewall letting it through? Test from your own computer: nc -vz 203.0.113.10 8080, or in Windows Test-NetConnection 203.0.113.10 -Port 8080. Connection refused means the firewall let the connection through but nothing is listening on the port. A long wait followed by timed out means the connection is being dropped, usually by a firewall.
3. Docker. Docker opens the ports of its containers itself, bypassing ufw and firewalld — more details.
4. Your own network. Some office and public networks don’t allow connections out to unusual ports. Try from another connection — for example, from your phone using mobile data.

If a database needs to be reached from your computer, you may not need to open the port at all — connect through an SSH tunnel instead.