Linux Firewall Cheat Sheet: ufw and firewall-cmd Side by Side

# ufw (Ubuntu, Mint, Debian if installed)
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose

# firewalld (Fedora, RHEL family, openSUSE)
sudo firewall-cmd --permanent --add-service={ssh,http,https}
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Both tools are front ends to the kernel's nftables packet filter. ufw is simple and rule-based; firewalld groups interfaces into zones and has a separate runtime and permanent configuration. Use the one your distro ships and never run both at once. The step-by-step setup, including Docker interaction, is in the ufw and firewalld guide.

Install, enable and check status

Allow and deny ports and services

After any --permanent change, run sudo firewall-cmd --reload. ufw rules take effect immediately.

Restrict by source IP or interface

Need help writing a CIDR range like 192.168.1.0/24? Use the subnet calculator.

Defaults, zones and logging

nftables underneath

Common recipes

Fresh Ubuntu server with SSH, HTTP and HTTPS:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit OpenSSH
sudo ufw allow 'Nginx Full'      # or: sudo ufw allow 80,443/tcp
sudo ufw enable

Fedora workstation: open a development port for the local network only:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3000" protocol="tcp" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-rich-rules

Check from another machine whether a port is reachable:

nc -zv server.example.com 443
# "succeeded" = open; "refused" = nothing listening; timeout = filtered by a firewall

SSH listens on a custom port (see the SSH server guide):

sudo ufw allow 2222/tcp
sudo firewall-cmd --permanent --add-port=2222/tcp && sudo firewall-cmd --reload
sudo semanage port -a -t ssh_port_t -p tcp 2222   # also needed on SELinux systems

Gotchas

• firewalld runtime vs permanent. A rule without --permanent vanishes on reload; a rule with only --permanent is not active until you reload. Use both, or --runtime-to-permanent.
• Docker bypasses ufw. Published container ports (-p 8080:80) are opened in Docker's own chains before ufw sees them. Bind to 127.0.0.1:8080:80 or use the DOCKER-USER chain.
• Rule order in ufw. The first matching rule wins. To block an IP that an earlier rule allows, use ufw insert 1 deny from ....
• Refused vs timed out. "Connection refused" means the packet arrived and nothing is listening; a firewall that drops packets causes a timeout, and a reject rule can cause No route to host.
• Cloud firewalls. On AWS, Azure, GCP or a VPS panel, a security group can block traffic before it reaches your host firewall. Open the port in both places.
• IPv6. ufw applies rules to IPv6 when IPV6=yes in /etc/default/ufw (the default). firewalld zones cover both families unless you use family="ipv4" in a rich rule.

Upstream documentation: UFW on help.ubuntu.com, firewalld.org and nftables on the Arch Wiki.

Frequently asked questions