How do I allow a public HTTPS service through UFW?
For a public HTTPS listener on TCP 443, UFW can allow that port explicitly. The firewall rule does not install a web server, provide a certificate or create a listener. First confirm that public access is intended and that the service is configured for the hostname you will test.
Before you start
- Administrative permission to expose this service publicly.
- A configured HTTPS listener and a hostname with the correct DNS records.
Instructions
1. Confirm the listener and current rules
Check which process owns port 443 and whether it is bound to an appropriate server address. If only local access is intended, keep the service private and use the approved proxy or tunnel.
sudo ss -lntp 'sport = :443'
sudo ufw status verboseInspects the service and existing firewall policy without changing either.
2. Preview and add only HTTPS
Review the dry-run output, then apply the separate command if it matches the intended exposure. Port 80, HTTP/3 UDP 443 and administrative ports are separate decisions.
sudo ufw --dry-run allow 443/tcpPreviews the TCP HTTPS rule.
sudo ufw allow 443/tcp
sudo ufw status numberedApplies the HTTPS rule and displays the result.
3. Test from outside the server
Use an authorised external client and the real hostname. A local successful request cannot verify the provider firewall, public routing or external DNS.
curl.exe --head --connect-timeout 5 --max-time 15 https://app.example.com/Runs a certificate-verified HTTPS check from Windows PowerShell.
Check the result
- The external client reaches the intended HTTPS site with a valid certificate and expected response.
Troubleshooting
- The request still times out
- Inspect provider firewall rules, DNS, IPv6 readiness and listener binding. Do not open unrelated port ranges.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.