How to Disable the Firewall in Linux
On Ubuntu, sudo ufw disable stops the firewall now and after reboot. On AlmaLinux, Rocky Linux and RHEL, sudo systemctl disable --now firewalld does the same. Check with sudo ufw status or sudo firewall-cmd --state. On a live server, open the one blocked port instead of leaving every port exposed.
For VPS and server admins chasing a blocked port who need the exact command for their distribution, and the safer alternative.
knowledge
- Read time
- 4 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
Which Linux firewall is running: UFW, firewalld or nftables?
Ubuntu uses UFW, the RHEL family (AlmaLinux, Rocky Linux, RHEL, CentOS Stream, Fedora) uses firewalld, and Debian enables no firewall front end by default. All of them program the kernel's netfilter, so identify the front end before switching anything off.
| Front end | Default on | Turn off now and at boot | Check |
|---|---|---|---|
| UFW | Ubuntu (installed, initially disabled) | sudo ufw disable | sudo ufw status |
| firewalld | AlmaLinux, Rocky, RHEL, CentOS Stream, Fedora | sudo systemctl disable --now firewalld | sudo firewall-cmd --state |
| nftables service | Debian (when configured) | sudo systemctl disable --now nftables | sudo nft list ruleset |
| iptables service | Older or hand-built hosts | sudo systemctl disable --now iptables | sudo iptables -S |
command -v ufw && sudo ufw status
systemctl is-active firewalld nftables iptables 2>/dev/null
sudo nft list ruleset | head -40The last command shows the rules actually loaded, whichever tool wrote them. On a fresh Ubuntu server UFW is often installed but inactive, so disabling it changes nothing; the block is elsewhere.
How to disable the UFW firewall on Ubuntu
Run sudo ufw disable; UFW stops filtering immediately and stays off after a reboot. Confirm with sudo ufw status, which should print "Status: inactive".
sudo ufw disable
sudo ufw statusYou do not need systemctl disable ufw as well, because ufw disable already persists. Your rules are kept, so sudo ufw enable later restores them exactly.
How to disable firewalld on AlmaLinux, Rocky Linux and RHEL
Run sudo systemctl disable --now firewalld, which stops the service and stops it starting at boot in one command. sudo firewall-cmd --state should then print "not running".
sudo systemctl disable --now firewalld
sudo firewall-cmd --statestop on its own lasts only until the next reboot, and disable on its own leaves the daemon running until then. Use sudo systemctl mask firewalld only if another package keeps starting it, and remember to unmask before re-enabling.
Clearing raw iptables or nftables rules without locking yourself out
Set the INPUT policy to ACCEPT before you flush, because flushing rules under a DROP policy cuts your SSH session instantly. Save a copy first so you can put the rules back.
sudo iptables-save | sudo tee /root/iptables-backup.rules
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -FRestore with sudo iptables-restore < /root/iptables-backup.rules. Do this from a second SSH session or the VPS console, so a mistake in the first session is recoverable. On nftables-only hosts, sudo nft list ruleset > /root/nft-backup.nft saves the set before sudo nft flush ruleset.
Open one port instead of disabling the Linux firewall
If one service times out, allow that port and leave the firewall on; a firewall switched off "for testing" is how SSH and databases end up open to the internet. Allow by source address wherever the public does not need access.
| Port | Who needs it | Safer rule |
|---|---|---|
| 22 (SSH) | Administrators | Your office IP only |
| 80 and 443 | Website visitors | Anywhere |
| 3306 (MySQL) | Your app server | That server's IP only |
| Control panel port | Administrators | Your IP only |
# UFW
sudo ufw allow 80,443/tcp
sudo ufw allow proto tcp from 203.0.113.10 to any port 22
# firewalld
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" service name="ssh" accept'
sudo firewall-cmd --reloadReplace 203.0.113.10 with your own address. If one address was banned by mistake, unblock that IP address and put fail2ban on Ubuntu in front of SSH, so the port can stay open safely.
Why Docker ports stay open even with UFW enabled
Docker's documentation states that published container ports are routed in the nat table before UFW's INPUT rules see them, so UFW does not filter them. Turning UFW on or off therefore changes nothing for a container started with -p 8080:80.
To keep a container private, publish it on localhost only (-p 127.0.0.1:8080:80) and put a reverse proxy in front, or use the provider's network firewall. On firewalld hosts, Docker adds its bridge interfaces to its own docker zone with an ACCEPT target.
How to turn the Linux firewall back on safely
Allow SSH first, then enable the firewall, then test from a second window before closing the first. Enabling UFW without an SSH rule drops your own connection.
# Ubuntu
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose
# AlmaLinux / Rocky / RHEL
sudo systemctl unmask firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --list-allufw enable asks for confirmation because it may disrupt SSH; scripts use sudo ufw --force enable. Success means SSH still connects, 80 and 443 answer, and a random high port is refused or times out.
Why a VPS port is still blocked after disabling the firewall
The server's own firewall and the provider's network firewall are separate locks; disabling one does not open the other. A proxy such as Cloudflare, or SELinux denying a service its port, are further layers that no firewall command touches.
On a WebJi® VPS, check any firewall rules in the client area as well as the ones on the server, and use the VPS console if SSH drops. For SELinux, sudo ausearch -m avc -ts recent shows recent denials. If you are stuck, email support@webji.services, staffed 24/7 in Hindi and English with an average first reply under 60 minutes.
Frequently asked questions
Is it safe to disable the firewall on a VPS?
Only for a few minutes of testing, and with a plan to re-enable it. With no filter, SSH, databases and panels accept connections from the whole internet, and automated scanners probe public addresses constantly. Open the one port you need instead.
How do I disable the firewall temporarily so it comes back on its own?
On firewalld, sudo systemctl stop firewalld lasts until the next reboot. A safer pattern on any host is to schedule the re-enable, for example sudo systemd-run --on-active=10m /usr/sbin/ufw --force enable right after disabling, so a forgotten test does not leave the server open.
Does Debian have a firewall enabled by default?
No front end is active on a default Debian install. The nftables tools may be present, but you choose whether to configure /etc/nftables.conf, install UFW, or install firewalld. Check with sudo nft list ruleset before assuming a block exists.
Does disabling the firewall turn off SELinux or AppArmor?
No. SELinux and AppArmor control what programs may do on the host, not which packets arrive. If a service still cannot bind or connect after the firewall is off, check those logs rather than switching security layers off one by one.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.