Open game server ports on Linux with UFW

Configuring the firewall of a Linux game server comes down to controlling inbound and outbound traffic at the machine level. UFW, for Uncomplicated Firewall, provides a readable command-line interface for managing the network rules of Ubuntu and many Debian-based distributions. The goal is not to open every port: you must allow the game, remote administration, and the services you actually use, then deny the rest.

This guide is for administrators who run a VPS or a dedicated server. It explains how to preserve SSH, distinguish TCP from UDP, restrict a rule to an IP address when possible, and check blocked packets. The local firewall rules do not replace any network filtering located at the hosting provider, on a router, or behind NAT equipment.

Before you begin

Connect with an account that has sudo rights. Avoid working directly as root when it is not necessary and keep a working SSH authentication. Note the server's public IP address, the authorized administration IP addresses if you have several, and the port number used by the game server.

A port can carry TCP, UDP, or both. This depends on the game software and its configuration. It must not be inferred from the game's name alone. Keep an SSH session already open during the first changes and use a second session to verify the result.

If your server uses the standard SSH port, allow TCP 22:

sudo ufw allow 22/tcp

If SSH listens on another port, replace 22 with that port. You can restrict administration to a trusted IP address:

sudo ufw allow from ADRESSE_IP_ADMIN to any port 22 proto tcp

Replace ADRESSE_IP_ADMIN with a known and stable value. Don't enable UFW until you have allowed the administration protocol you need.

Checking the firewall state

Start by reading the current state and the rules already present:

sudo ufw status verbose

On a fresh installation, UFW may be inactive. This does not mean the server is protected by default. The local firewall rules, the datacenter network, and any security groups are distinct layers. Document the open ports and the services to keep before changing the policy.

If you need to install UFW on a compatible distribution, first check your version's documentation and the available packages. On Ubuntu, the package and the service are usually already provided for this setup. Don't apply a command meant for another distribution without checking its package manager.

Allowing the game server ports

For a TCP service, specify the port and the protocol:

sudo ufw allow 30120/tcp

For a UDP service, create a separate UDP rule:

sudo ufw allow 30120/udp

If a game server uses both protocols, check both rules. For a port range, use an explicit syntax and limit it to the actual need:

sudo ufw allow 30000:30100/udp

You can add a comment to make the rule easier to reread:

sudo ufw allow 30120/udp comment 'Game server'

Adapt these examples to the port configured on the server. Don't open an entire range out of habit: a broader rule increases the network surface and the number of accepted inbound packets without fixing poor application configuration.

For a console reserved for administrators, prefer a known source rather than a worldwide opening:

sudo ufw allow from ADRESSE_IP_ADMIN to any port PORT_ADMIN proto tcp

The ufw allow command opens the indicated port according to the chosen protocol, but it does not modify the game's configuration. If a network interface listens on IPv4 and IPv6, check both address families and verify that the rule matches the traffic actually received.

Defining policies and enabling UFW

A common baseline for a server is to deny new unauthorized inbound connections and allow outbound connections:

sudo ufw default deny incoming
sudo ufw default allow outgoing

This policy lets outbound services work while requiring an explicit rule for the game and administration inbound ports. Then reread the rules with their numbers:

sudo ufw status numbered

Enable UFW only after checking the SSH rule:

sudo ufw enable

Confirm the activation and check the active rules. If the game remains inaccessible, also check the listening address, the server process, routing, the DNS resolution used by players, and any upstream network rules. An allowed firewall cannot make a service available if it is not listening on any IP address.

Testing from outside

A test run from the same server is not always enough. From an outside machine, check the port with the tool suited to your environment, then look at the UFW logs if an expected connection is blocked:

sudo ufw status verbose
sudo journalctl -k | grep -i ufw

Test TCP and UDP separately when the service uses both. A UDP port cannot be checked exactly like a TCP port: the absence of a response does not always prove it is closed. The best check remains a real connection with the game client or the protocol concerned.

When analyzing a failure, note the source IP address, the destination port number, the protocol, and the time. This information lets you distinguish a UFW rule from a DNS problem, a wrong IP address, a stopped service, or filtering located outside the server. Also check the connection from the Internet, not only from the local administration network.

Understanding the network layer

UFW provides a readable configuration, then applies the firewall rules in the Linux network stack. Depending on the system version, the processing may rely on the netfilter and iptables mechanisms or on their nftables compatibility. It is therefore not recommended to mix direct iptables commands with UFW without knowing which configuration is persistent.

The command line in a shell lets you separate three subjects: the service that listens, the network interfaces that receive the packets, and the firewall that decides whether to accept them. A correct UFW rule does not fix a wrong IP address, a misconfigured port, or a router that does not forward the traffic. Before manually adding a new exception, check the service's configuration and log.

After a change, reread the effective configuration with ufw status verbose and record the added rule in your operating configuration files. This practice avoids confusing a temporary rule, a persistent rule, and filtering applied by another network interface.

Removing a rule and rolling back

Display the rules with their numbers:

sudo ufw status numbered

To delete a rule by its number, use the number displayed after verification:

sudo ufw delete NUMERO

To temporarily disable UFW in case of a configuration error, use:

sudo ufw disable

This command removes the UFW filtering, but it does not fix the game server's configuration or an external network rule. After the diagnosis, restore a documented policy and test SSH access again before closing your rescue session.

Final checklist

• The SSH port actually used and its protocol are allowed before activation.
• Each game port is associated with the correct TCP or UDP protocol.
• Administration rules are limited to an IP address when possible.
• Port ranges are limited to the strict minimum.
• sudo ufw status verbose confirms the expected policy.
• The game server listens on the right IP address and port.
• An external test confirms access from the players' network.
• The logs and blocked packets are reviewed in case of failure.
• The rules and their purpose are recorded for future maintenance.

To go further, also see our guide to the first security settings, the network diagnostic for an unreachable VPS, our Ubuntu VPS page, the Docker on a VPS guide, and our dedicated servers page.