UFW Firewall – Open Ports Without Locking SSH (Minecraft, Web, SSH)

This guide shows you how to open and close ports on your server – both on Linux and Windows. This protects your server from unwanted access and only makes those services accessible that really need to be reached.

Note: Detailed subpages on security and network can be found in the left navigation.

Linux: UFW (Uncomplicated Firewall)

UFW is pre-installed on Ubuntu and Debian. It's the easiest way to manage ports.

Installation and activation

# Installation (usually pre-installed)
sudo apt install ufw

# Important: Allow SSH first, then enable!
sudo ufw allow 22/tcp
sudo ufw enable

Show status

# Shows all rules with numbers
sudo ufw status numbered

# Detailed view
sudo ufw status verbose

Opening ports

# Single port
sudo ufw allow 80/tcp

# Port range
sudo ufw allow 27000:27100/tcp

# Allow for a specific IP
sudo ufw allow from 192.168.1.100 to any port 22

Closing ports

# By port number
sudo ufw deny 3306/tcp

# By number from "ufw status numbered"
sudo ufw delete 3

# Delete complete rule
sudo ufw delete allow 80/tcp

Default rules

# Block all incoming
sudo ufw default deny incoming

# Allow all outgoing
sudo ufw default allow outgoing

Important ports for game servers

Linux: Firewalld (CentOS/RHEL)

# Show status
sudo firewall-cmd --list-all

# Open port
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --reload

# Close port
sudo firewall-cmd --permanent --remove-port=80/tcp
sudo firewall-cmd --reload

Windows: Windows Firewall

Via GUI (graphical)

1. Open Windows Settings → Update & Security → Windows Security
2. Click Firewall & Network Protection → Advanced Settings
3. Select Inbound Rules or Outbound Rules on the left
4. Click New Rule on the right
5. Select Port → TCP or UDP → Enter specific ports
6. Choose action: Allow the connection or Block the connection
7. Select profile (Domain, Private, Public)
8. Give it a name and click Finish

Via PowerShell (faster)

# Open port (TCP)
New-NetFirewallRule -DisplayName "Minecraft Server" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow

# Open port (UDP)
New-NetFirewallRule -DisplayName "Minecraft Server" -Direction Inbound -Protocol UDP -LocalPort 25565 -Action Allow

# Close port / delete rule
Remove-NetFirewallRule -DisplayName "Minecraft Server"

# Show all rules
Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' }

Via Command Prompt (CMD)

# Open port
netsh advfirewall firewall add rule name="Minecraft" dir=in action=allow protocol=TCP localport=25565

# Close port / delete rule
netsh advfirewall firewall delete rule name="Minecraft"

Check ports – which ones are open?

Linux

# Show running services with ports
sudo ss -tlnp

# Even more details
sudo netstat -tlnp

Windows

# Show all open ports
netstat -an

# Only listening ports
netstat -an | findstr LISTENING

Avoid common mistakes

• Don't block the SSH port: Always make sure port 22 stays open – otherwise you'll lock yourself out
• Don't forget UDP: Many game servers need UDP, not just TCP
• Check before activating: With UFW, first open all required ports, then enable
• Test the firewall: After changes, use a port scanner (e.g. from another computer) to test if the desired ports are open

Detailed guides on security and network can be found in the articles in the left navigation.

Frequently asked questions (FAQ)