How to Disable the Firewall in Linux

Which Linux firewall is running: UFW, firewalld or iptables

Name the tool before you disable it. Ubuntu and Debian ship UFW. AlmaLinux, Rocky Linux, RHEL, CentOS Stream and Fedora ship firewalld. A host from the RHEL 6 era may still have an iptables service. nftables is the filter those front ends program. It is not a separate on/off switch.

• command -v ufw, then sudo ufw status, shows whether UFW is installed and active.
• systemctl is-active firewalld prints active or inactive.
• sudo iptables -S | head shows the current filter rules, not which service owns them.

If ufw is missing and firewalld is inactive, you are not looking at a modern host firewall. Read the iptables section before you flush rules you cannot put back.

Check whether the Linux firewall is on

The firewall is off when UFW says inactive or firewalld says not running. An empty iptables listing is not the same fact, because firewalld can be running with only its default zone.

• sudo ufw status. Inactive means UFW is not filtering. Active means it is.
• sudo firewall-cmd --state. It prints running or not running. A missing command means firewalld is not installed.
• systemctl is-active firewalld prints active or inactive.
• sudo nft list ruleset shows rules that iptables -L can hide on an nftables-only host.

A fresh Ubuntu server often has UFW installed and inactive until someone runs ufw enable. Disabling it then changes nothing. If a port still fails, the block is somewhere else.

Disable UFW on Ubuntu and Debian

sudo ufw disable stops UFW at once and keeps it stopped after reboot. sudo ufw status should then print Status: inactive.

1. Run sudo ufw status and note whether it is active.
2. Run sudo ufw disable.
3. Run sudo systemctl disable ufw so the unit does not start at boot.
4. Run sudo ufw status again. Inactive, plus a successful connection from a second machine, means this step worked.

systemctl disable ufw is extra. ufw disable already persists. Use both when systemctl is-enabled ufw still says enabled after ufw disable.

Disable firewalld on AlmaLinux, Rocky Linux and RHEL

sudo systemctl disable --now firewalld stops firewalld and keeps it from starting at boot. sudo firewall-cmd --state should then say not running.

1. Run sudo firewall-cmd --state.
2. Run sudo systemctl disable --now firewalld.
3. If a package starts firewalld again through D-Bus, run sudo systemctl mask firewalld. A masked unit stays down until you unmask it.
4. Run systemctl status firewalld. Inactive (dead) is the result you want. Masked appears on the Loaded line only if you masked it.

sudo systemctl stop firewalld lasts until the next reboot. sudo systemctl disable firewalld leaves the daemon running until you reboot or stop it. disable --now is the pair. The same sequence applies on AlmaLinux, Rocky Linux, RHEL 7 and later, and CentOS Stream.

Flush iptables rules without disabling the firewall

sudo iptables -F deletes rules in the filter table until reboot, or until UFW or firewalld writes them back. It does not disable either service.

On a SysV host the old commands are sudo service iptables stop and sudo chkconfig iptables off. On systemd that service name is often missing. If both front ends are already inactive, run sudo nft list ruleset before you flush, so you can see what is loaded.

Flushing INPUT can cut the SSH session that holds your allow rule. Open a second SSH session, or the VPS console, before you flush. Put the rules back from that second session if the first one dies.

Open one port instead of disabling the Linux firewall

A timeout on one port is an allow-rule problem. Disabling the firewall to test, and then leaving it off, is how SSH and databases end up open to the internet.

On UFW, sudo ufw allow 80,443/tcp opens the web ports, and sudo ufw allow from YOUR.IP to any port 22 proto tcp opens SSH for one address. On firewalld, add the http and https services with sudo firewall-cmd --permanent --add-service=http --add-service=https, then reload.

A single address that is banned is not a firewall you should turn off. Clear that address with the steps to unblock an IP address, then put fail2ban on Ubuntu in front of SSH so the port can stay open.

Turn the Linux firewall back on

On Ubuntu, allow SSH before you enable anything: sudo ufw allow OpenSSH, then sudo ufw enable. sudo ufw status verbose should list 22/tcp and show Status: active.

On firewalld, sudo systemctl unmask firewalld if the Loaded line says masked, then sudo systemctl enable --now firewalld. sudo firewall-cmd --state should say running.

Prove it from a second window. SSH still connects, ports 80 and 443 answer for a website, and a random high port times out or is refused. Close the first session only after those three are true.

Why the VPS firewall still blocks a port

The operating-system firewall and the provider firewall are two locks. sudo ufw disable does not open a port the provider still drops, and a provider allow does not help while UFW is rejecting the same port.

On a Linux VPS, check both the rules you just edited and any firewall or security group in the client area. If SSH dies, use the console there. Email support@webji.services, staffed 24/7 in Hindi and English, with an average first reply under 60 minutes. Do not treat the office phone as a support line.

A Cloudflare challenge is a different lock. Disabling UFW or firewalld does not clear a proxy rule, and it does not turn SELinux off. setenforce 0 is a separate control, not a firewall command.