How to Check, Open, and Close Ports in Ubuntu Linux

Overview

Open network ports expose services. Misconfigured ports invite unauthorized access. Network auditing hardens Ubuntu installations. Guide details socket inspection, firewall configuration, daemon management.

Core Utilities

ss: Reads socket statistics direct from Linux kernel. Replaces netstat. Zero /proc parsing overhead.
lsof: Maps active sockets to process IDs. Pinpoints running binary locations.
UFW: Manages netfilter rules. Simplifies packet filter configuration.
systemd: Controls service lifecycles. Terminates listening daemons at source.

Check Active Ports

Install diagnostic tools first:

sudo apt update && sudo apt install -y iproute2 net-tools lsof

Follow this ordered sequence to audit listening sockets:

Run the ss command to list all listening TCP and UDP sockets with numeric addresses:
```
sudo ss -tuln
```
The flags represent: -t for TCP, -u for UDP, -l for listening sockets, and -n for numerical port resolution.
Include process names and process IDs (PID) to identify which application owns each open socket:
```
sudo ss -tulpn
```
Cross-reference open ports with the lsof utility to isolate active network daemons:
```
sudo lsof -i -P -n | grep LISTEN
```
Alternatively, query the legacy netstat tool if your scripts require backward compatibility:
```
sudo netstat -tuln
```

CRITICAL SECURITY WARNING: If you are managing your Ubuntu server over a remote SSH session, do not enable UFW until you have explicitly opened port 22 (or your custom SSH port). Enabling the firewall without an explicit SSH allow rule will permanently disconnect your current session and lock you out of the server.

Open and Close Ports Using UFW

Follow these steps in sequence to manage firewall access safely:

Check the current operating state of UFW:
```
sudo ufw status verbose
```
Allow SSH connections before activating the packet filter:
```
sudo ufw allow 22/tcp
```
Enable UFW to enforce firewall rules:
```
sudo ufw enable
```
Open required service ports. For example, open HTTP (port 80) and HTTPS (port 443):
```
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```
Deny traffic to close a port explicitly:
```
sudo ufw deny 80/tcp
```
Delete an existing rule safely by identifying its rule index:
```
sudo ufw status numbered
```
Locate the target rule number in the brackets, then delete it:
```
sudo ufw delete <rule_number>
```

Manage Listening Services via systemd

Close ports at service level using systemd:

Map the listening port to its service unit using the PID obtained from ss -tulpn:
```
systemctl status <PID>
```
Stop the running daemon immediately to release the port:
```
sudo systemctl stop <service_name>
```
Disable the service to prevent automatic restart on subsequent system boots:
```
sudo systemctl disable <service_name>
```

Tip: Reload UFW after manual profile modifications with sudo ufw reload to apply changes without dropping active states.

Production Considerations

Docker bypasses UFW chains. Docker manipulates iptables directly. Unintended external exposure occurs. Configure /etc/docker/daemon.json with "iptables": false or bind containers strictly to 127.0.0.1.
ss command execution outperforms netstat. ss leverages kernel netlink interface directly. netstat parses /proc/net text structures line by line. Use ss on busy systems.
High packet volume causes log saturation. Limit write frequency via sudo ufw logging low.

Summary and Upstream Documentation

Port maintenance combines socket auditing, packet filtering, service control. Audit regularly. Close unused sockets.

How to Check, Open, and Close Ports in Ubuntu Linux