How do I read UFW firewall rules without changing them?
UFW status provides a convenient view of the rules managed by UFW. Read the source, destination, protocol and direction together; an allow rule for one source address does not permit all clients. These commands inspect policy and do not enable, disable or reload the firewall.
Before you start
- Sudo access to inspect firewall policy.
Instructions
1. Read the general policy
Check whether UFW reports active and review the default incoming, outgoing and routed policies. If it reports inactive, do not assume another firewall or provider rule is absent.
sudo ufw status verboseShows UFW state, default policies and its user-visible rules.
2. Read the numbered entries
Numbers describe the current order and can change after edits. For an investigation, copy the relevant rule text and time, not just its current number.
sudo ufw status numberedLists current user rules with numbers; it does not delete or reorder them.
3. Compare with the service
Check that the service actually listens on the expected address and protocol. A TCP rule does not permit UDP. IPv6 entries and container-published traffic need their own review.
sudo ss -lntp 'sport = :443'Checks whether a process is listening on the example HTTPS TCP port.
Check the result
- The rule scope matches the intended client and service, and the service has the expected listener.
- An authorised client test confirms the complete path; rule inspection alone cannot prove reachability.
Troubleshooting
- An allowed port still refuses connections
- Connection refusal often indicates no listener or an explicit rejection. Confirm the application and bind address before adding more rules.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.