Cybersecurity Triage
Changes system stateRead UFW Policy Verbosely
You need the UFW default policy, logging state, and allowed inbound rules in one readable snapshot.
Command
ufw status verboseBefore you run this
System impact: Changes system or application state. Needs inspection, scoping, and rollback notes before production use.
When not to use it: Do not assume UFW is the only firewall layer on every host; nftables, iptables, cloud firewalls, and provider rules may also apply.
Expected output
UFW status, default policy, logging state, and inbound rules.
System impact
Changes system state. Nothing changes. This UFW command prints the current policy and rule summary, but firewall state still deserves careful review.
Recovery / rollback: no state is changed.
When to use it
Use during exposure checks, handoffs, or after a deploy changes which services should be reachable.
When not to use it
Do not assume UFW is the only firewall layer on every host; nftables, iptables, cloud firewalls, and provider rules may also apply.
Watch this command run
Command transcript
This sanitized transcript shows the commands and output shape without exposing host details.
$ ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
22/tcp ALLOW IN 203.0.113.0/24
80/tcp ALLOW IN Anywhere
443/tcp ALLOW IN Anywhere
25/tcp ALLOW IN Anywhere
5432/tcp DENY IN Anywhere$ ufw status numbered
Status: active
To Action From
-- ------ ----
[ 1] 22/tcp ALLOW IN 203.0.113.0/24
[ 2] 80/tcp ALLOW IN Anywhere
[ 3] 443/tcp ALLOW IN Anywhere
[ 4] 25/tcp ALLOW IN Anywhere
[ 5] 5432/tcp DENY IN AnywhereView commands shown
These are the commands shown in the sanitized transcript.
Commands shown
ufw status verboseufw status numbered
next steps
Related commands
Find Allowed Ports with No Listener
An open firewall rule can outlive the service it was created for.
comm -23 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '/LISTEN/ {n=split($4,a,":"); print a[n]}' | sort -u)
Find Public Listeners Not Allowed by UFW
The process was public, but the firewall did not mention it.
comm -13 <(ufw status numbered | awk '/ALLOW/ {print}' | grep -Eo '[0-9]+/(tcp|udp)' | cut -d/ -f1 | sort -u) <(ss -ltnp | awk '$4 ~ /^(0[.]0[.]0[.]0|[[]::[]]|[*]):/ {n=split($4,a,":"); print a[n]}' | sort -u)
List Numbered UFW Rules
Numbered rules make firewall review less ambiguous.
ufw status numbered
Show the nftables Input Chain
The packet path was hiding below UFW.
nft list ruleset | sed -n '/chain input/,/}/p'
List Listening TCP Sockets
Firewall rules matter after you know what is listening.
ss -ltnp
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Useful for
- LPIC-1 style command-line practice
- LFCS style performance tasks
- Linux+ style troubleshooting review
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.