Cybersecurity Triage
Read-only, sensitive outputRead UFW Policy Verbosely
You need the UFW default policy, logging state, and allowed inbound rules in one readable snapshot.
Command
ufw status verboseBefore you run this
System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.
When not to use it: Do not assume UFW is the only firewall layer on every host; nftables, iptables, cloud firewalls, and provider rules may also apply.
Expected output
UFW status, default policy, logging state, and inbound rules.
System impact
Read-only, sensitive output. Nothing changes. This UFW command prints the current policy and rule summary, but firewall state still deserves careful review.
Recovery / rollback: no state is changed.
When to use it
Use during exposure checks, handoffs, or after a deploy changes which services should be reachable.
When not to use it
Do not assume UFW is the only firewall layer on every host; nftables, iptables, cloud firewalls, and provider rules may also apply.
next steps
Related commands
Find Allowed Ports with No Listener
An open firewall rule can outlive the service it was created for.
comm -23 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '/LISTEN/ {n=split($4,a,":"); print a[n]}' | sort -u)
Find Public Listeners Not Allowed by UFW
The process was public, but the firewall did not mention it.
comm -13 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '$4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/ {n=split($4,a,":"); print a[n]}' | sort -u)
List Numbered UFW Rules
Numbered rules make firewall review less ambiguous.
ufw status numbered
Show the nftables Input Chain
The packet path was hiding below UFW.
nft list ruleset | sed -n '/chain input/,/}/p'
List Listening TCP Sockets
Firewall rules matter after you know what is listening.
ss -ltnp
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.