Troubleshoot Linux firewall access safely

Before you begin

A shell and access to the target environment; use authorized, non-production practice systems for changes.

Record the host, time, user impact, and recent changes. Begin with read-only checks so you have evidence before modifying a running system.

Inspect and understand

A service must listen before firewall access can work. Also check cloud security groups, routing, NAT, and upstream filters.

sudo ss -lntp
sudo nft list ruleset
sudo ufw status verbose
sudo firewall-cmd --state

Read the command output in context. Confirm the exact host, process, resource, account, cluster, or workspace before taking action. Missing output can also reflect permissions or a different tool version.

Act on what you find

Change one identified cause at a time. Prefer the system’s service manager, deployment source, package manager, or configuration owner rather than editing a generated or ephemeral state directly.

For infrastructure, network, firewall, and service changes, follow the local approval and rollback procedure. Keep sensitive values out of shell history, logs, screenshots, and public tickets.

Verify and follow up

Apply one approved rule, preserve rollback access, test externally, and confirm unrelated ports remain blocked.

Compare the result with the original symptom, check logs or health indicators, and note the change and any remaining uncertainty. A successful command exit does not always prove the service is healthy.