Every service on your GoZen VPS listens on a port. Web traffic uses 80 and 443, SSH uses 22, databases use 3306. If a port isn’t open in your firewall, traffic can’t reach the service - even if the service is running perfectly.

This guide covers how to open, close, and verify ports on Ubuntu/Debian (UFW) and Rocky/AlmaLinux (firewalld), plus raw iptables for edge cases.

Common Hosting Ports

Before opening anything, know what you need:

PortProtocolServiceOpen to Public?
22TCPSSHYes (or restrict to your IP)
80TCPHTTPYes
443TCPHTTPSYes
25TCPSMTP (outgoing mail)Outgoing only
587TCPSMTP SubmissionYes (if running mail)
993TCPIMAPSYes (if running mail)
465TCPSMTPSYes (if running mail)
3306TCPMySQL/MariaDBNo - restrict to localhost or specific IPs
5432TCPPostgreSQLNo - restrict to localhost or specific IPs
6379TCPRedisNo - restrict to localhost
8080TCPAlternative HTTP / Dev serversDepends on use case
8443TCPAlternative HTTPS / Control panelsDepends on use case
2083TCPcPanelYes (if using cPanel)
2087TCPWHMYes (if using cPanel)

Check What’s Currently Listening

Before opening a port, verify that a service is actually listening on it:

  # Show all listening ports with process names
sudo ss -tlnp

# Check a specific port (e.g., port 3000)
sudo ss -tlnp | grep :3000

# Alternative: using lsof
sudo lsof -i :3000

If nothing is listening on the port, opening it in the firewall won’t help - you need to start the service first.

Check Current Firewall Rules 

  # Check if UFW is active
sudo ufw status

# Verbose output with rule numbers
sudo ufw status numbered

If UFW is inactive, see our Firewall Setup Guide to enable it properly.

  # Check if firewalld is running
sudo firewall-cmd --state

# List all allowed services and ports
sudo firewall-cmd --list-all

# List only open ports
sudo firewall-cmd --list-ports

Open a Port 

  # Open a single TCP port
sudo ufw allow 3000/tcp

# Open a UDP port
sudo ufw allow 53/udp

# Open both TCP and UDP
sudo ufw allow 53

# Open a port range
sudo ufw allow 8000:8100/tcp

# Open a port only for a specific IP
sudo ufw allow from 203.0.113.50 to any port 3306

# Open a port for a subnet
sudo ufw allow from 10.0.0.0/8 to any port 3306
  
  # Open a single TCP port (permanent)
sudo firewall-cmd --permanent --add-port=3000/tcp

# Open a UDP port
sudo firewall-cmd --permanent --add-port=53/udp

# Open a port range
sudo firewall-cmd --permanent --add-port=8000-8100/tcp

# Open by service name (if a predefined service exists)
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Apply changes
sudo firewall-cmd --reload

Restrict to a specific IP (using rich rules):

  sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" port protocol="tcp" port="3306" accept'
sudo firewall-cmd --reload

Close a Port 

  # Delete a rule by specification
sudo ufw delete allow 3000/tcp

# Or delete by rule number (safer for complex rules)
sudo ufw status numbered
sudo ufw delete 5    # replace 5 with the rule number

# Explicitly deny a port
sudo ufw deny 8080/tcp
  
  # Remove a port
sudo firewall-cmd --permanent --remove-port=3000/tcp

# Remove a service
sudo firewall-cmd --permanent --remove-service=http

# Apply changes
sudo firewall-cmd --reload

Verify a Port is Reachable

After opening a port, verify it’s actually reachable from outside your server.

From Inside the Server 

  # Confirm the service is listening
sudo ss -tlnp | grep :3000

# Confirm the firewall rule exists
sudo ufw status | grep 3000        # UFW
sudo firewall-cmd --list-ports     # firewalld

From Outside the Server 

  # From your local machine or another server
nc -zv your-server-ip 3000

# Using telnet
telnet your-server-ip 3000

# Using nmap (scans the port)
nmap -p 3000 your-server-ip

# Using curl (for HTTP services)
curl -I http://your-server-ip:3000

If the port shows as filtered or connection times out, the firewall is blocking it.

Raw iptables (Advanced)

If you’re not using UFW or firewalld, or need to debug at a lower level:

  # List all rules
sudo iptables -L -n -v

# Open a port
sudo iptables -A INPUT -p tcp --dport 3000 -j ACCEPT

# Open a port for a specific IP only
sudo iptables -A INPUT -p tcp -s 203.0.113.50 --dport 3306 -j ACCEPT

# Block a port
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP

# Save rules (so they persist after reboot)
sudo apt install iptables-persistent -y    # Ubuntu/Debian
sudo netfilter-persistent save

sudo dnf install iptables-services -y      # Rocky/AlmaLinux
sudo service iptables save

Common Scenarios

Open Ports for a Node.js / Next.js App

Your app runs on port 3000 but you want users to access it on port 80/443:

  # Option 1: Open port 3000 directly (for testing)
sudo ufw allow 3000/tcp

# Option 2 (recommended): Use Nginx as a reverse proxy
# Keep port 3000 closed to the public
# Open only 80 and 443
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

See Nginx Reverse Proxy for the full setup.

Open Ports for a Game Server

Game servers often use UDP and non-standard ports:

  # Example: Minecraft (TCP 25565)
sudo ufw allow 25565/tcp

# Example: Valheim (UDP 2456-2458)
sudo ufw allow 2456:2458/udp

See Hosting a Game Server for specific game configurations.

Temporarily Open a Port for Debugging 

  # Open now, but don't persist across reboots (firewalld)
sudo firewall-cmd --add-port=9090/tcp
# This will be gone after firewall-cmd --reload or reboot

# UFW doesn't have a "temporary" mode, so open and close manually:
sudo ufw allow 9090/tcp
# ... debug ...
sudo ufw delete allow 9090/tcp

Troubleshooting

ProblemFix
Port shows as filtered from outsideThe firewall is blocking it. Check your rules with ufw status or firewall-cmd --list-all.
Port is open in firewall but still not reachableIs the service actually running? Check with sudo ss -tlnp | grep :PORT.
Service is running but only on 127.0.0.1The service is bound to localhost only. Change its config to listen on 0.0.0.0 (all interfaces).
“Connection refused” instead of timeoutThe port is reachable but nothing is listening. Start the service.
UFW is inactiveEnable it: sudo ufw enable. Make sure you allow SSH first!
Rules lost after reboot (firewalld)You forgot --permanent. Re-add with --permanent and --reload.
Rules lost after reboot (iptables)Install iptables-persistent (Debian/Ubuntu) or iptables-services (RHEL) and save.
Docker ignores UFW rulesDocker modifies iptables directly, bypassing UFW. See our Firewall Setup Guide for the Docker workaround.

Last updated 21 Apr 2026, 08:08 +0300. history

Was this page helpful?