How do I identify which firewall manages my Linux server?
Linux firewall policy may be managed by UFW, firewalld, a direct nftables configuration or another platform tool. A provider firewall can also filter traffic before it reaches the server. Discover the active owner before making changes: installing a second manager can create conflicting policies.
Before you start
- Administrative access for reading the complete local ruleset.
Instructions
1. Identify installed tools and units
Installed commands show available software, not necessarily the component currently controlling policy. A one-shot service can load rules and then exit, so an inactive service is not proof that the firewall is empty.
command -v ufw firewall-cmd nft
systemctl is-active ufw firewalld nftablesChecks available management tools and unit states. Missing tools or units are normal when another manager is used.
2. Inspect the applicable manager
Run the relevant command only for tools present on this system. Read the current policy without resetting or reloading it.
sudo ufw status verboseFor UFW systems, displays whether UFW is active and its reported policy.
sudo firewall-cmd --get-active-zonesFor running firewalld systems, identifies zones attached to interfaces or sources.
3. Check other policy layers
Review the service’s provider-side firewall and any container port publishing. Docker can add forwarding/NAT rules that are not represented by an ordinary UFW application rule.
Check the result
- You can name the local policy manager, relevant interface or zone and any upstream filtering layer before proposing a rule change.
Troubleshooting
- The operating-system firewall looks open but clients time out
- Check provider filtering, routing, the listening socket and the client network. Do not clear local rules to test an unconfirmed cause.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.