How do I remove one obsolete UFW rule without resetting the firewall?
Delete the exact rule that is no longer required, after checking its purpose and dependencies. Resetting the firewall removes unrelated protections and is unnecessary for this task. The example removes a previously approved source-specific TCP 8443 rule; substitute the exact obsolete rule on your server.
Before you start
- Confirmation that the rule is unused.
- Independent management access if the port affects administration.
Instructions
1. Identify the complete rule
Review current entries and check application owners before removal. A numbered entry can move after another administrator edits policy, so prefer the full rule definition when practical.
sudo ufw status numberedLists the current rules for inspection.
2. Preview the deletion
Use the same protocol, source and destination port as the obsolete rule. A deletion that targets a broad allow can have a wider effect than removing one source-specific entry.
sudo ufw --dry-run delete allow proto tcp from 198.51.100.20 to any port 8443Previews removal of this exact example allow rule.
3. Apply and check the resulting policy
Run the deletion only when the preview and affected service are confirmed. Recheck current rules immediately, then test that the intended remaining services still work.
sudo ufw delete allow proto tcp from 198.51.100.20 to any port 8443
sudo ufw status numberedRemoves the matching rule and shows the updated policy.
Check the result
- The obsolete rule is absent and the remaining administrative and application paths still work.
- A broader existing allow has not unintentionally kept the old service exposed.
Troubleshooting
- Could not delete a non-existent rule
- Compare the exact rule syntax, source range, protocol and IPv6 variant. Do not delete a different entry simply because its port looks similar.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.