How to Add Firewall Rule in Linux

If you want to know how to add firewall rule in linux, the exact command depends on which firewall tool your system uses. Most Linux distributions use UFW, firewalld, or iptables, and the basic process is the same: identify the tool, create the rule, verify it, and test that the service still works.

Quick answer

The fastest way to add a firewall rule in Linux is to use the firewall manager already installed on your system. On Ubuntu and many Debian-based systems, that is often UFW. On Fedora, RHEL, CentOS, and Rocky Linux, it is often firewalld. iptables is still used on some servers, especially for older setups or custom configurations.

For example, to allow SSH on UFW you would run:

sudo ufw allow 22/tcp

To allow SSH on firewalld, you would run:

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

If you are unsure which firewall is active, check it first before making changes.

Identify which firewall you are using

Before you add a rule, find out which firewall service is active. The command depends on the tool, but these checks work well on most Linux systems.

• UFW: sudo ufw status
• firewalld: sudo firewall-cmd --state
• iptables rules: sudo iptables -L -n -v
• nftables rules: sudo nft list ruleset

If one tool is active, use that tool rather than mixing commands across multiple firewall systems. Mixing them can make troubleshooting harder.

Add a rule with UFW

UFW, short for Uncomplicated Firewall, is designed to make common firewall tasks simple. It is a good choice for beginners and for servers that only need straightforward allow and deny rules.

Allow a port with UFW

Use this when you want to open a port, such as a web server or custom application port.

sudo ufw allow 80/tcp

That opens HTTP traffic on TCP port 80. To allow HTTPS, use:

sudo ufw allow 443/tcp

Allow a service with UFW

UFW can also allow named services if they are defined in its service list.

sudo ufw allow ssh

This is useful because it is easier to read than remembering the port number.

Allow traffic from a specific IP address or subnet

If you only want to allow one trusted host or network, you can restrict the rule by source.

sudo ufw allow from 203.0.113.10 to any port 22 proto tcp

To allow a whole subnet:

sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp

This is safer than opening a port to the entire internet when only a few systems need access.

Enable UFW and verify the rule

If UFW is disabled, you may need to turn it on after adding your rule. Be careful if you are connected over SSH, and make sure SSH access is allowed first.

sudo ufw enable
sudo ufw status numbered

The status output shows whether the rule is active and in what order it appears.

Add a rule with firewalld

firewalld is common on Red Hat-based systems and uses zones to group rules. The default zone is often the one you need, but you can check your active zone before adding rules.

Allow a port with firewalld

To open a port permanently, use:

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --reload

The first command saves the change. The second command applies it immediately.

Allow a service with firewalld

Using a service name is often easier than using a port number when the service is predefined.

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Other common service names include http and https, depending on your setup and installed service definitions.

Allow traffic from a specific IP address

firewalld can also permit access from a trusted source address.

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="22" protocol="tcp" accept'
sudo firewall-cmd --reload

For a subnet, replace the source address with CIDR notation such as 203.0.113.0/24.

Check the active firewalld rules

sudo firewall-cmd --list-all

This command shows the active zone, allowed services, open ports, and rich rules.

Add a rule with iptables

iptables is more manual than UFW or firewalld, but it is still important to understand because many servers and scripts use it directly. With iptables, rules are applied in order, so placement matters.

Allow a port with iptables

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

This appends a rule that accepts incoming TCP traffic on port 80.

Allow SSH from a specific IP

sudo iptables -A INPUT -p tcp -s 203.0.113.10 --dport 22 -j ACCEPT

This is a safer way to allow remote administration from one trusted host.

Make iptables rules persistent

iptables rules often disappear after reboot unless you save them with a persistence method provided by your distribution. The exact package and service vary by system, so use the persistence tool available on your server rather than assuming rules will survive a restart.

After saving, verify the rules again so you know the saved configuration matches what is active now.

Allow a port, service, or IP address

These three ideas sound similar, but they solve slightly different problems.

If the service already has a known definition in your firewall tool, allowing the service is usually simpler. If not, use the port number directly.

Verify the rule is active

After adding a firewall rule, always confirm that it exists and is active. Verification prevents silent mistakes, such as opening the wrong protocol or forgetting to reload the firewall.

Check UFW

sudo ufw status verbose

Check firewalld

sudo firewall-cmd --list-all

Check iptables

sudo iptables -L -n -v

Check nftables

sudo nft list ruleset

If the rule does not appear, make sure you edited the correct firewall tool and saved the rule in the right zone, chain, or table.

Test connectivity after the change

Once the rule is in place, test the service from another machine if possible. For example, if you opened SSH, web, or database ports, confirm that the remote client can connect.

• Try connecting with ssh for port 22.
• Use a browser or curl for web ports 80 and 443.
• Use the application’s normal client for custom services.

If the service still fails, the firewall may be only one part of the problem. The application might not be running, might be listening on the wrong interface, or another network rule may still block traffic.

Common mistakes and safety checks

Firewall changes are small, but a few common mistakes can cause confusion or lock you out.

• Forgetting SSH access: If you are connected remotely, allow SSH before enabling stricter rules.
• Opening the wrong protocol: TCP and UDP are not interchangeable.
• Using the wrong firewall tool: Don’t configure UFW if firewalld is actually managing the system.
• Forgetting to reload: firewalld often needs a reload after permanent changes.
• Assuming rules are persistent: Some iptables changes vanish after reboot unless saved properly.
• Allowing too much access: A public open port is broader than a source-restricted rule.

If you are working on a remote server, keep one active session open while testing new rules. That way, if you make a mistake, you can still correct it without losing access completely.

Which firewall method should you use?

If you are still deciding which commands to use, this simple guide can help.

• Use UFW if you want a simpler command set and your distro supports it well.
• Use firewalld if your system already uses it, especially on RHEL-based distributions.
• Use iptables if you need direct rule control or are maintaining an older system.
• Use nftables if your distribution has moved to it and you want the modern packet filtering framework.

The best choice is usually the one already managing your system’s firewall. Replacing it without a plan can create conflicts or break existing access rules.

Frequently Asked Questions About how to add firewall rule in linux

How do I add firewall rule in Linux?

First identify whether your system uses UFW, firewalld, iptables, or nftables. Then add the rule with that tool, verify it, and test the service from another machine.

Which command do I use for UFW, firewalld, or iptables?

Use ufw allow for UFW, firewall-cmd --add-port or --add-service for firewalld, and iptables -A for direct rule creation.

How do I allow a port through the Linux firewall?

Open the specific port and protocol you need, such as 80/tcp for a web server or 22/tcp for SSH. Always confirm whether the application uses TCP or UDP.

How do I make a firewall rule permanent in Linux?

With UFW, rules are generally persistent. With firewalld, use the --permanent option and reload the firewall. With iptables, use your distribution’s persistence method so the rule survives a reboot.

How do I check if a firewall rule is active?

Use the status or list commands for your firewall tool. For UFW, run ufw status. For firewalld, run firewall-cmd --list-all. For iptables, use iptables -L -n -v.

Is it safe to open a firewall port to everyone?

Sometimes yes, but only when the service is meant to be publicly accessible. If the service is administrative or sensitive, it is safer to restrict access by source IP or subnet.

Conclusion

The right way to add a firewall rule in Linux depends on the firewall you are using, but the process is straightforward once you identify it. UFW is simple, firewalld is common on enterprise Linux, and iptables offers direct control for lower-level rule management. Whichever tool you use, keep SSH access in mind, make the rule as narrow as practical, and verify the result before moving on.

If you want the safest approach, start by allowing only the exact port, protocol, or source address you need, then test the connection from another system.