$ Linux One Liners
Back to problems

problem hub

Read-only first

Firewall port blocked on Linux

Prove the service is listening, then read host firewall rules before opening ports.

Safest first command

ss -ltnp

Before you run this

Expected output: Listening TCP sockets with local address, port, and process details when permissions allow.

When not to use it: Do not open firewall ports before proving the service should be reachable and is listening on the intended address.

Expected output example

LISTEN 0 4096 127.0.0.1:8080 0.0.0.0:* users:(("app",pid=4242,fd=7))

How to read the result

A listener on 127.0.0.1 is local-only. A public listener still may be blocked by UFW, firewalld, nftables, iptables, or provider firewalls.

What to check next

No LISTEN row for the port

Means: The firewall may not be the first problem; the service is not accepting connections locally.

Next step: Inspect service state before changing firewall rules.

Find Listening Ports with ss

Listener is localhost-only

Means: The app is not bound to a public address.

Next step: Check service config and reverse proxy path.

Inspect One Service Without Pager Traps

Host firewall denies or lacks the port

Means: Firewall policy may block intended traffic.

Next step: Read UFW, firewalld, and nftables state before adding rules.

Read UFW Policy Verbosely

Firewall decision tree

Check listener, bind address, host firewall, and provider firewall in that order. Opening a port without confirming the service owner can expose the wrong process.

  1. ss -ltnp
  2. sudo ufw status verbose
  3. sudo firewall-cmd --list-all
  4. sudo nft list ruleset

Provider firewall branch

Use this branch when the obvious first check is inconclusive. Keep the next step read-only and confirm ownership before changing service, package, or access state.

  1. systemctl --failed --no-pager
  2. journalctl -b --no-pager -p warning..alert | head

Bad fixes to avoid

Do not open broad ranges or 0.0.0.0 exposure before confirming service owner, intended port, and upstream cloud firewall policy.

Common causes

  • Service not listening
  • Bound only to localhost
  • Host firewall deny policy
  • Cloud/provider firewall block
  • Wrong port or protocol

What not to change yet

  • Do not add allow rules before checking the listener.
  • Do not assume UFW is the only firewall layer.
  • Do not expose admin ports publicly without access controls.

Stop and escalate if

  • The next step could interrupt users, remove data, or lock out access.
  • The output includes secrets, customer data, or private infrastructure details.
  • You cannot explain the blast radius of the repair command.

supporting commands

Command path

Guides and drills