UFW Firewall – Open Ports Without Locking SSH (Minecraft, Web, SSH)

This guide shows you how to open and close ports on your server – both on Linux and Windows. This protects your server from unwanted access and only makes those services accessible that really need to be reached.

Note: Detailed subpages on security and network can be found in the left navigation.

Linux: UFW (Uncomplicated Firewall)

UFW is pre-installed on Ubuntu and Debian. It's the easiest way to manage ports.

Installation and activation

# Installation (usually pre-installed)
sudo apt install ufw

# Important: Allow SSH first, then enable!
sudo ufw allow 22/tcp
sudo ufw enable

Show status

# Shows all rules with numbers
sudo ufw status numbered

# Detailed view
sudo ufw status verbose

Opening ports

# Single port
sudo ufw allow 80/tcp

# Port range
sudo ufw allow 27000:27100/tcp

# Allow for a specific IP
sudo ufw allow from 192.168.1.100 to any port 22

Closing ports

# By port number
sudo ufw deny 3306/tcp

# By number from "ufw status numbered"
sudo ufw delete 3

# Delete complete rule
sudo ufw delete allow 80/tcp

Default rules

# Block all incoming
sudo ufw default deny incoming

# Allow all outgoing
sudo ufw default allow outgoing

Important ports for game servers

Linux: Firewalld (CentOS/RHEL)

# Show status
sudo firewall-cmd --list-all

# Open port
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --reload

# Close port
sudo firewall-cmd --permanent --remove-port=80/tcp
sudo firewall-cmd --reload

Windows: Windows Firewall

Via GUI (graphical)

1. Open Windows Settings → Update & Security → Windows Security
2. Click Firewall & Network Protection → Advanced Settings
3. Select Inbound Rules or Outbound Rules on the left
4. Click New Rule on the right
5. Select Port → TCP or UDP → Enter specific ports
6. Choose action: Allow the connection or Block the connection
7. Select profile (Domain, Private, Public)
8. Give it a name and click Finish

Via PowerShell (faster)

# Open port (TCP)
New-NetFirewallRule -DisplayName "Minecraft Server" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow

# Open port (UDP)
New-NetFirewallRule -DisplayName "Minecraft Server" -Direction Inbound -Protocol UDP -LocalPort 25565 -Action Allow

# Close port / delete rule
Remove-NetFirewallRule -DisplayName "Minecraft Server"

# Show all rules
Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' }

Via Command Prompt (CMD)

# Open port
netsh advfirewall firewall add rule name="Minecraft" dir=in action=allow protocol=TCP localport=25565

# Close port / delete rule
netsh advfirewall firewall delete rule name="Minecraft"

Check ports – which ones are open?

Linux

# Show running services with ports
sudo ss -tlnp

# Even more details
sudo netstat -tlnp

Windows

# Show all open ports
netstat -an

# Only listening ports
netstat -an | findstr LISTENING

Avoid common mistakes

• Don't block the SSH port: Always make sure port 22 stays open – otherwise you'll lock yourself out
• Don't forget UDP: Many game servers need UDP, not just TCP
• Check before activating: With UFW, first open all required ports, then enable
• Test the firewall: After changes, use a port scanner (e.g. from another computer) to test if the desired ports are open

Detailed guides on security and network can be found in the articles in the left navigation.