PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Managing ports safely means more than adding a firewall rule. First find the services that are actually listening, then document each service’s protocol, port, bind address and permitted source networks. Allow only the traffic you need, permit and test SSH before enabling a restrictive policy, make rules persistent, and verify access from another host. On Ubuntu, UFW provides a straightforward interface; on distributions that use firewalld, use zones and permanent rules. A firewall cannot make a stopped service reachable, and a service bound only to loopback is not publicly reachable. The procedure below applies to both VPS and dedicated servers and includes a recovery-safe method for changing SSH ports.
What does an open port mean on a VPS or dedicated server?
An open port is a network port bound to a service that is actively listening for incoming connections or packets. Ubuntu Security Documentation uses that definition, so a firewall rule by itself does not create a listening service. Conversely, a listening service may still be unreachable if a host firewall, an upstream network policy or an incorrect bind address blocks it.
Recommended Free Tools
Think of port management as two separate controls:
- Application listener: the daemon chooses a protocol and port and binds to an address.
- Packet filter: UFW, firewalld or another netfilter policy decides which sources may reach that listener.
Both controls must agree. A web server listening on TCP 80 but blocked by the firewall is unavailable; a firewall rule allowing TCP 80 does nothing if no process listens there. Ubuntu recommends limiting traffic to open ports and closing ports that are not needed.
How do I inventory listening ports before changing firewall rules?
Start with an inventory rather than guessing from a service list. On Linux, run:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
ss -utlnThe flags display listening TCP and UDP sockets numerically. To identify the owning process, use root privileges:
sudo ss -utlnpRecord the local address, port, protocol and process for every listener. A line bound to 127.0.0.1 or ::1 is loopback-only; it is not directly exposed to the internet. A line bound to a specific private address is reachable only through networks that can route to that address. Bindings such as 0.0.0.0, [::] or * accept on all available addresses and deserve extra scrutiny.
What to capture for each listener
- Service name and owning process.
- TCP, UDP or both.
- Numeric port.
- Bind address, including whether IPv4 and IPv6 differ.
- Required source networks: all internet clients, a corporate CIDR, a VPN subnet or localhost only.
- Whether the service is intentional, temporary or obsolete.
Save this inventory before edits. It gives you a baseline for detecting an accidental exposure after a reboot or package change.
How do I map a service to the smallest safe rule?
For every service you intend to expose, define the protocol, port, bind address and source range together. Port numbers are conventions, not proof of the software running there; the service configuration and the ss output are authoritative.
| Decision | Safer choice | Why it matters |
|---|---|---|
| Protocol | Allow only TCP or UDP required by the application | Opening both protocols doubles the paths that must be maintained. |
| Port | Use the configured service port | A rule for a conventional number does not redirect traffic to a different listener. |
| Bind address | Use loopback or a private address for internal services | It prevents an unnecessary internet-facing listener. |
| Source | Restrict to an administration subnet, VPN or known client CIDR | Fewer permitted sources reduce exposure compared with an all-source rule. |
| Address family | Check IPv4 and IPv6 separately | An IPv6 listener can remain reachable even when an IPv4 rule looks correct. |
Do not use a wildcard bind merely because a firewall rule exists. If a database, metrics endpoint or administration panel needs only local access, bind it to loopback or a private interface and do not publish a public rule.
How do I allow ports with UFW on Ubuntu?
UFW is Ubuntu’s default firewall frontend over netfilter/iptables. The safe order is to allow your current administration path, inspect the rule set, then enable or tighten the policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Confirm your session and required SSH source. Keep the existing SSH connection open. If administration comes from one subnet, note its CIDR before writing a source-restricted rule.
- Allow SSH before enabling UFW. The broad example is
sudo ufw allow 22. Ubuntu also provides an OpenSSH application profile, which you can allow withsudo ufw allow OpenSSH. For a restricted administration network, use syntax such assudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp, replacing the example CIDR with your real subnet. - Add each required application rule. Examples are
sudo ufw allow 80/tcpfor HTTP orsudo ufw allow 443/tcpfor HTTPS. Add UDP only when the service documentation requires it. - Inspect before activation. Run
sudo ufw status numberedto see rule order and numbering. Numbered output makes later deletion unambiguous. - Enable the policy. Run
sudo ufw enableonly after confirming that your SSH rule is present. Confirm the prompt and keep the current session open. - Remove mistakes explicitly. Use
sudo ufw delete allow 80/tcpfor a matching rule, or delete by number after reviewingsudo ufw status numbered.
UFW rules can be scoped by source and destination, and application profiles can represent common services. Avoid broad all-source rules when a management subnet or VPN is available. After every change, check both UFW status and the listener inventory; a permitted rule without a listener is harmless but may conceal a service-start failure.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do I allow ports with firewalld?
firewalld organizes policy into zones and can allow either a numeric port or a named service. Runtime changes take effect immediately but are temporary; permanent changes must be written and then loaded.
Open a numeric port
sudo firewall-cmd --zone=public --add-port=80/tcpReplace public with the zone attached to the server’s interface. The command opens the port in the current runtime configuration.
Allow a named service
sudo firewall-cmd --zone=public --add-service=httpA service definition expresses the port and protocol associated with that service. Use a numeric rule when you deliberately run a service on a nonstandard port.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMake the change survive reloads and reboots
- Repeat the change with
--permanent, for examplesudo firewall-cmd --zone=public --permanent --add-port=80/tcp. - Reload firewalld:
sudo firewall-cmd --reload. - Verify the effective configuration with
sudo firewall-cmd --zone=public --list-all. - Recheck
ss -utlnand test from a remote host.
firewalld documentation states that a permanently added port remains open after a system reboot or firewalld service reload. If you use only the runtime form, a reload or restart removes the exception.
How do UFW and firewalld differ?
Choose the firewall native to the distribution rather than stacking competing frontends. Both ultimately manage packet filtering, but their operating models differ.
| Comparison | UFW | firewalld |
|---|---|---|
| Typical distribution role | Ubuntu’s default frontend over netfilter/iptables | Zone-based firewall service used by distributions that ship firewalld |
| Rule style | Commands such as ufw allow 443/tcp, source restrictions and application profiles |
Zones with named services or numeric ports such as 80/tcp |
| Source restriction | Supported with from and destination clauses |
Apply rules in the appropriate zone; source and interface assignment determine scope |
| Persistence | Managed by UFW’s enabled policy | Runtime rules are temporary; add --permanent and reload |
| Inspection | ufw status numbered |
firewall-cmd --zone=ZONE --list-all |
| Recovery concern | Do not enable before allowing SSH | Do not reload or restart until the required SSH rule is permanent |
Do not infer that a port is open simply because a command succeeded. Confirm the active zone or UFW policy, then verify the service listener and remote reachability.
How do I change the SSH port without locking myself out?
Change the SSH listener and its firewall rule in a controlled sequence, keep an existing session, and test a second connection before closing anything. Have console or rescue access available because a syntax error, wrong bind address or missed firewall rule can otherwise require provider-side recovery.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Choose and document the new port. Use a port permitted by your organization and provider policies. Check that no existing service is listening there with
sudo ss -utlnp. - Open the new port first. In UFW, add the new TCP port (and restrict the source when possible). In firewalld, add it to the correct zone both at runtime and permanently. Keep the old SSH rule temporarily.
- Update the SSH listener. Traditional installations use the
Portdirective in/etc/ssh/sshd_config. Ubuntu 24.04 and later may instead use socket activation withListenStreamin/lib/systemd/system/ssh.socket, as documented by OVH. Inspect the active unit and change the setting that actually controls your host; do not assume the traditional file is authoritative. - Reload systemd when a socket unit changed. Run
sudo systemctl daemon-reload, then restart the socket withsudo systemctl restart ssh.socket. If your installation uses the daemon directly, restart the corresponding SSH service only after validating its configuration. - Test from a second terminal. Connect with
ssh -p NewPortNumber user@serverwhile the original session remains open. Confirm authentication, privilege escalation and any required forwarding. - Remove the old rule only after confirmation. Delete the old port from UFW or firewalld, then verify the new listener with
ssand test again after a firewall reload.
Never restart SSH first and plan to open the firewall afterward. If the new rule is absent or the listener fails to start, the current session may be your only access path.
How do I verify that a port is really reachable?
Verification has three layers: the process, the host firewall and an independent remote connection. A successful local check alone does not prove internet reachability.
- Check the process: run
sudo ss -utlnpand confirm the expected protocol, port and bind address. - Check the firewall: review
sudo ufw status numberedor the firewalld zone listing. Confirm that the rule is in the active policy, not merely a temporary or inactive zone. - Test from another network: connect from a separate host using the service’s client or a TCP probe such as
nc -vz SERVER_ADDRESS PORT. For UDP, use an application-aware test because UDP has no handshake that proves delivery. - Repeat after reload and reboot: firewalld runtime-only rules disappear on reload, and services may change listeners during startup. Recheck both the firewall and
ssoutput.
When testing, use the server’s public IPv4 and public IPv6 addresses separately. A rule or listener working on one address family does not automatically establish reachability on the other.
Why is a port open locally but unreachable from the internet?
The most common cause is a mismatch between the listener’s bind address and the address you are testing, followed by a firewall or routing policy that blocks the path.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Listener is loopback-only
If ss shows 127.0.0.1:PORT or ::1:PORT, only local processes can connect. Change the application bind setting to the required private or public interface, then restart the service and recheck the socket. Do not change it to a wildcard address unless public exposure is intentional.
Protocol mismatch
A TCP rule does not permit UDP and a UDP rule does not permit TCP. Confirm the client’s protocol and the service documentation before adding another rule.
Wrong firewall scope
On firewalld, the interface may belong to a different zone than the one you edited. On UFW, a source-restricted rule may exclude the address used for testing. Inspect the active zone, interface assignment and source CIDR rather than adding a second unrestricted rule.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Rule is not persistent
A firewalld runtime exception can vanish after reload or reboot. Add the same rule with --permanent, reload, and verify the resulting zone.
Service is not running
A stopped or failed daemon leaves no listener. Check the process shown by ss -utlnp, inspect the service’s own status and logs, correct its configuration, and only then revisit the firewall.
Which common ports should I expect?
Port numbers are conventions. DigitalOcean classifies 0–1023 as well-known, 1024–49151 as registered or user ports, and 49152–65535 as dynamic or private ports. The service configuration remains authoritative, so inventory listeners instead of opening an entire range.
| Service convention | Typical port | Typical protocol | Management implication |
|---|---|---|---|
| SSH | 22 | TCP | Allow before enabling a restrictive firewall; restrict by source where practical. |
| HTTP | 80 | TCP | Open only when a web service is actually listening. |
| HTTPS | 443 | TCP | Confirm the TLS-enabled service and its bind address. |
| Other applications | Service-specific | TCP, UDP or both | Use the application’s configured values; do not rely on a convention. |
The ranges describe numbering categories, not security levels. A high-numbered port is not intrinsically private, and a well-known port is not automatically required.
How do I close ports and reduce exposure?
Closing an unnecessary listener is stronger than merely blocking it. Remove or disable the service when it is not needed, bind internal components to loopback or private addresses, and then remove the corresponding firewall rule.
- Stop the service and disable its automatic startup when it is obsolete.
- Delete unused UFW rules or remove firewalld services and ports from both runtime and permanent configuration.
- Replace all-source rules with a management subnet, VPN range or specific client CIDRs.
- Review wildcard binds and change them to the narrowest interface that supports the application.
- Apply security updates and repeat the listener inventory after upgrades.
Keep a record of why every remaining public port exists, who needs it and which protocol it uses. That record makes later reviews and incident response faster.
What is the fastest recovery path after an accidental lockout?
Use an out-of-band console or rescue environment supplied for the server, restore the last known-good firewall rule or SSH listener, and test before disconnecting the console. If an existing SSH session remains open, use it to inspect ss, correct the active UFW or firewalld policy, and restore the previous port temporarily.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Identify whether the failure is a missing listener, a blocked protocol, a source restriction or a wrong firewalld zone.
- Restore only the minimum rule needed for administration.
- Validate configuration syntax and restart the affected service cautiously.
- Open a second remote session and verify the intended port.
- Remove emergency broad rules and document the permanent correction.
Do not repeatedly enable and disable firewall services without checking which policy is active; doing so can hide the original cause and leave an inconsistent state.
What should I check during routine port reviews?
A short recurring review catches drift between application configuration and firewall policy.
- Run
sudo ss -utlnpand compare listeners with the approved service inventory. - Check for new wildcard or IPv6 binds.
- Review UFW numbered status or each firewalld zone’s complete listing.
- Confirm that required rules survive a firewalld reload and a planned reboot.
- Test critical services from an independent network.
- Remove abandoned services, source ranges and temporary exceptions.
- Keep console or rescue credentials available before changing SSH or default policies.
This workflow separates discovery, policy, persistence and verification. It prevents the two most damaging assumptions: that a firewall rule creates a service, and that a local connection proves public reachability.
Frequently Asked Questions
Can I run UFW and firewalld at the same time?
Using two competing frontends can produce contradictory rules and make troubleshooting difficult. Select the firewall framework supported by the distribution, manage policy through that tool, and verify the resulting netfilter state after changes.
How can I tell whether an IPv6 port is exposed?
Inspect the IPv6 listeners in ss output, looking for addresses such as [::] or a public IPv6 address, and test the server’s IPv6 address from an IPv6-capable network. An IPv4-only test cannot establish that IPv6 is blocked.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does changing the SSH port remove the need for source restrictions?
No. A nonstandard port changes where the daemon listens but does not limit who can reach it. Keep the firewall rule restricted to the administration subnet or VPN whenever your operating model allows it.
Why did my firewalld rule disappear after a reboot?
The rule was likely added only to the runtime configuration. Add the same port or service with --permanent, reload firewalld, list the zone, and then perform a controlled reboot test.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
