Common Ports & firewall commands: Look up and open ports

Each port gets a card showing its service, TCP or UDP, IANA status, port range and OSI layer, with a security warning for sensitive ports, plus ready-to-use commands for five firewalls. For a FiveM server using ufw, for example: sudo ufw allow 30120/tcp, sudo ufw allow 30120/udp. Then click “Check port” to test whether the port is reachable from outside.

Well-known Ports (System Ports) are port numbers 0 to 1023. IANA assigns them to common standard services such as SSH (22), HTTP (80) and HTTPS (443). On Linux, a service on these ports needs root privileges or the CAP_NET_BIND_SERVICE capability by default. Above them are the Registered Ports (1024 to 49151) and dynamic ports (49152 to 65535).

For running servers and networking exams such as CompTIA Network+ or the German IHK exam, the key ports are: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 80 HTTP, 110 POP3, 123 NTP, 143 IMAP, 161 SNMP, 389 LDAP, 443 HTTPS, 445 SMB, 465 and 587 for sending email, 993 IMAPS, 995 POP3S, 1433 Microsoft SQL Server, 3306 MySQL, 3389 RDP, 5432 PostgreSQL, and 8080 as the alternative HTTP port. In total, port numbers range from 0 to 65535, separately for TCP and UDP. The port list below the tool shows the most important ports by category and can switch to IANA-assigned ports.

TCP establishes a connection before transmitting and ensures everything arrives complete and in the correct order, for example with websites, email and SSH. UDP sends packets without establishing a connection or checking delivery. That makes it faster and well suited to DNS queries, voice and games. A firewall rule applies to only one protocol, so a service like FiveM needs two rules.

It depends on the firewall: Ubuntu and Debian usually use ufw (sudo ufw allow 443/tcp), while Rocky Linux, AlmaLinux, and RHEL use firewalld (sudo firewall-cmd --permanent --add-port=443/tcp followed by --reload). Without a frontend, you use iptables or nftables directly. The tool generates commands for all four firewalls, including for a port range or a specific IP only.

The quickest way is to run New-NetFirewallRule in PowerShell as an administrator, for example New-NetFirewallRule -DisplayName “Port 443 TCP” -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow. You can remove the rule with Remove-NetFirewallRule and the same name. The tool generates both commands for you.

On the server, sudo ss -tulpn shows which service is listening on which port. To test whether the port is reachable from outside, use the port checker: the “Check port” button opens it with your ports. If a port is closed, the service isn’t running, is listening only on localhost or is blocked by a firewall.

Databases (3306, 5432, 6379, 27017), Remote Desktop (3389), Windows file shares (445), the Docker API (2375) and admin interfaces should not be publicly accessible. Allow access only from a specific IP address, or use a VPN or SSH tunnel. Telnet (23) and FTP (21) transmit passwords in plain text and have been replaced by SSH and SFTP.

Yes. Set the source to “Specific IP” and enter an IPv4 or IPv6 address or a network in CIDR notation, such as 203.0.113.10 or 198.51.100.0/24. The tool validates your input and includes the address in the rules: as from … to any port for ufw, with -s for iptables, with saddr for nftables, as a rich rule for firewalld, and with -RemoteAddress for Windows. The “Database” preset automatically sets the source to “Specific IP”.

Turn on “Show commands to close ports again”: ufw removes the rule with sudo ufw delete allow, iptables uses -D instead of -I, firewalld uses --remove-port or --remove-rich-rule and --reload, and Windows uses Remove-NetFirewallRule with the same name. For nftables, display the chain with sudo nft -a list chain inet filter input and delete the rule by its handle number. To make rules persistent, save iptables rules with sudo netfilter-persistent save (iptables-persistent package); firewalld uses --permanent, and nftables rules must be in /etc/nftables.conf.