Linux Firewall for Game Servers: ufw and firewalld Commands

To open a game server port on Linux, use sudo ufw allow 2456:2457/udp on Ubuntu and Debian, or sudo firewall-cmd --permanent --add-port=2456-2457/udp followed by sudo firewall-cmd --reload on Fedora, Rocky Linux, AlmaLinux and other Red Hat style systems. Always allow SSH before enabling a firewall on a remote machine, check which zone firewalld put your network in, and remember that Docker publishes ports around ufw.

Which firewall do you have

Run these and see which one answers:

sudo ufw status
sudo firewall-cmd --state

• ufw ("Uncomplicated Firewall") is the default front end on Ubuntu and is easy to install on Debian. It may be installed but inactive.
• firewalld is the default on Fedora, RHEL, Rocky, AlmaLinux and openSUSE. It is usually running out of the box.
• If neither exists, the system may have no firewall rules at all, or plain nftables or iptables rules. Check with sudo nft list ruleset.

Do not run ufw and firewalld together. Pick one.

ufw: the commands you need

Allow SSH first, especially on a remote box, or you will lock yourself out when you enable the firewall:

sudo ufw allow OpenSSH

Then open the game's ports. Note ufw uses a colon for ranges and needs the protocol when you give a range:

# Minecraft Java
sudo ufw allow 25565/tcp

# Valheim
sudo ufw allow 2456:2457/udp

# Rust: game port and query port
sudo ufw allow 28015/udp
sudo ufw allow 28017/udp

# Project Zomboid
sudo ufw allow 16261:16262/udp

Turn it on and check:

sudo ufw enable
sudo ufw status numbered

Remove a rule by number:

sudo ufw delete 3

To restrict RCON or a web panel to your own IP only:

sudo ufw allow from 203.0.113.25 to any port 28016 proto tcp

firewalld: the commands you need

firewalld groups rules into zones. Your network interface belongs to one zone, usually public. Check:

sudo firewall-cmd --get-active-zones

Open ports in that zone. --permanent writes it to config; --reload applies it. Note firewalld uses a dash for ranges:

sudo firewall-cmd --permanent --add-port=25565/tcp
sudo firewall-cmd --permanent --add-port=2456-2457/udp
sudo firewall-cmd --permanent --add-port=8211/udp
sudo firewall-cmd --reload

List what is open:

sudo firewall-cmd --list-all

If your interface is in a different zone (for example home or FedoraWorkstation), add --zone=thatzone to each command. Adding a port to public while your interface sits in home is a classic "the rule is there but nothing works" moment.

Remove a port:

sudo firewall-cmd --permanent --remove-port=8211/udp
sudo firewall-cmd --reload

Ports for common games

Other games are in how to port forward a game server.

The Docker trap

If your game server runs in Docker and you publish ports with -p 2456:2456/udp, Docker writes its own iptables rules that bypass ufw. The port is reachable from the internet even if ufw says it is blocked. That surprises people in both directions: ports they meant to close are open, and they assume ufw is why something works.

Options:

• Accept that Docker controls published ports and only publish what you want public.
• Bind admin ports to localhost only: -p 127.0.0.1:28016:28016.
• Use the DOCKER-USER iptables chain for filtering that Docker respects.

firewalld integrates with Docker more cleanly through its docker zone on recent versions, but the same advice applies. More in running Docker game servers at home.

Cloud firewalls sit in front of Linux

On a VPS or cloud instance, there is often a second firewall in the provider's dashboard (called security groups, network firewall or similar). Opening a port in ufw does nothing if the cloud firewall still blocks it. Open the port in both places.

At home, the router is that second layer. You also need a port forward on the router; see the router guides and double NAT fix if things still do not connect.

Checking the server is actually listening

A firewall rule only helps if the server is bound to the right port. Check with:

sudo ss -tulpn | grep -E '2456|25565|8211'

You should see the server process on 0.0.0.0:port (all IPv4 addresses) or *:port. If it shows 127.0.0.1:port, the server is only listening locally, and you need to fix the bind address in the server config, not the firewall.

Logging what gets blocked

ufw can log dropped packets:

sudo ufw logging on
sudo tail -f /var/log/ufw.log

Have a friend try to join and watch for [UFW BLOCK] lines with your game's port. For firewalld, sudo firewall-cmd --set-log-denied=all turns on denied packet logging, viewable with journalctl -k.

Or skip the firewall work

Running your own Linux box teaches you a lot, but it also means you own every rule, update and open port. A GamezServers server has the game's ports open and DDoS protection on from the start, with a panel, live console, SFTP and one click backups. If you want the control without the admin work, look at custom game server hosting.

FAQ

Does ufw block game servers by default?

When enabled, ufw denies all incoming connections by default, so a game server needs an allow rule. If ufw is inactive, it blocks nothing.

Why does my firewalld rule disappear after a reboot?

You added it without --permanent. Runtime rules vanish on reload or reboot. Add it again with --permanent and run --reload.

Do I need separate rules for IPv6?

ufw creates IPv6 rules automatically when IPV6=yes is set in /etc/default/ufw, which is the default. firewalld port rules apply to both IPv4 and IPv6.

Can I open a port only for my friends?

Yes. Use ufw allow from <their IP> or a firewalld rich rule with a source address, but home IPs change, so you will be updating it often.