# How to Find Open Ports and Close Them in Linux

> URL: https://www.atlantic.net/dedicated-server-hosting/how-to-find-open-ports-and-close-them-in-linux/ | Published: 2024-09-22 | Updated: 2024-10-03 | Author: Hitesh Jethva

Managing open ports in Linux is crucial for system security. Open ports can be entry points for unauthorized access if not monitored properly.

This guide will walk you through finding open ports on your Linux system and how to close them to enhance your system’s security.

## What Are Open Ports in Linux?

An open port is a network port that accepts incoming connections. Ports are communication endpoints for networked devices, allowing services and applications to communicate over a network. There are two main types:

- **TCP Ports:** Ensure reliable communication with error checking.
- **UDP Ports:** Faster communication without error checking.

Each service or application running on your Linux system may listen on a specific port for incoming connections.

## How to Find Open Ports in Linux

There are several tools available to identify open ports on your Linux system:

- **netstat:** Network statistics tool.
- **ss:** Socket statistics, a modern replacement for netstat.
- **lsof:** Lists open files and ports.
- **nmap:** Network scanner for discovering hosts and services.

### 1. Using netstat to List Open Ports

The **netstat** command displays network connections, routing tables, and interface statistics.

```bash
netstat -tuln
```

Output:

```bash
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     
udp        0      0 0.0.0.0:68              0.0.0.0:*
```

This output shows SSH (port 22) and HTTP (port 80) are open and listening for connections.

**Explanation:**

- **-t:** Shows TCP connections.
- **-u:** Shows UDP connections.
- **-l:** Lists listening ports.
- **-n:** Displays addresses and port numbers in numerical form.

### 2. Using ss to Check Open Ports

The **ss** command provides similar functionality to netstat but is faster and more efficient.

```bash
ss -tuln
```

Output:

```bash
Netid  State      Recv-Q Send-Q    Local Address:Port        Peer Address:Port 
udp    UNCONN     0      0         0.0.0.0:68               0.0.0.0:*         
tcp    LISTEN     0      128       0.0.0.0:22               0.0.0.0:*         
tcp    LISTEN     0      128       [::]:80                  [::]:*
```

The output shows open ports similar to Netstat.

### 3. Using lsof to Find Listening Ports

The **lsof** command lists open files, which can include network connections since they are treated as files in Unix-like systems.

```bash
lsof -i -P -n | grep LISTEN
```

Output:

```bash
sshd      1234    root    3u  IPv4  1234567      0t0  TCP *:22 (LISTEN)
apache2   5678    www-data 3u  IPv6  7654321      0t0  TCP *:80 (LISTEN)
```

This output shows that sshd is listening on port 22 and apache2 is listening on port 80.

Options Explained:

- **-i:** Lists IP-related files.
- **-P:** Shows port numbers instead of service names.
- **-n:** Avoids DNS lookup for hostnames.

### 4. Scanning Open Ports with nmap

**nmap** is a powerful network scanning tool that can discover hosts and services on a network.

Run the following command to scan localhost.

```bash
nmap -sT localhost
```

Output:

```bash
Starting Nmap 7.60 ( https://nmap.org ) at 2023-10-01 12:00 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000012s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
```

This output shows that ports **22** and **80** are open on the localhost.

## How to Close Open Ports in Linux

To close an open port, you generally need to stop the service using it.

The basic syntax to stop the service is shown below:

```bash
systemctl stop service-name
```

For example, if you want to close HTTP port **80,** you will need to stop the Apache service.

```bash
systemctl stop apache2
```

To stop SSH port **22,** run the following command:

```bash
systemctl stop sshd
```

## Blocking Ports Using Firewall (iptables or UFW)

You can use firewall rules if you cannot stop a service but want to block access to a port.

**Using iptables to Block a Port**

```bash
iptables -A INPUT -p tcp --dport 80 -j DROP
```

Verify the added rules.

```bash
iptables -L
```

Output:

```bash
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  anywhere             anywhere             tcp dpt:80
```

**Using UFW to Block a Port**

UFW (Uncomplicated Firewall) is a user-friendly frontend for iptables.

To close/block the port 80, run:

```bash
ufw deny 80/tcp
```

Verify UFW Status:

```bash
ufw status
```

Output:

```bash
Status: active

To                         Action      From
--                         ------      ----
80/tcp                     DENY        Anywhere
80/tcp (v6)                DENY        Anywhere (v6)
```

## Conclusion

Monitoring and managing open ports is a fundamental aspect of Linux system security. Regularly checking for open ports and closing or securing them reduces potential vulnerabilities. You can now easily find open ports and close them on [dedicated server hosting](https://www.atlantic.net/dedicated-server-hosting/) from Atlantic.Net!