← Back to overviewAll commands
03 / FIELD NOTES
Check the listener, the bind address, UFW, Docker, and the cloud security group, in that order.
Most "port not open" problems are one of four layers: nothing listening, listening only on 127.0.0.1, a host firewall, or the provider security group. Check from the inside out so each step rules out one layer.
A service works on the server but times out or is refused from your computer.
PORT=25774
ss -lntp | grep ":$PORT "Expect: No output: nothing listens. 127.0.0.1:PORT: local only, reach it through an SSH tunnel or a reverse proxy. 0.0.0.0 or [::]: listening on every interface.
curl -sS -o /dev/null -w "%{http_code}\n" "http://127.0.0.1:$PORT"Expect: An HTTP code such as 200 or 302 means the service itself works.
docker ps --format 'table {{.Names}}\t{{.Ports}}'Expect: 0.0.0.0:PORT->... is public. 127.0.0.1:PORT->... is loopback only. Docker-published ports bypass UFW.
if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then firewall-cmd --list-all; elif command -v ufw >/dev/null 2>&1; then ufw status verbose; else echo "no host firewall tool active"; fiExpect: On Rocky/Alma/RHEL check firewalld ports/services. On Debian/Ubuntu check UFW. When the host firewall is active, a non-Docker service needs an allow rule.
Read-only. If every step looks right, open the port in your provider security group or firewall panel; it sits outside the server.
{
"slug": "port-unreachable",
"risk": "safe",
"tags": [
"ports",
"firewall",
"ufw",
"firewalld",
"docker"
],
"updated": "2026-10-30",
"pathIndex": null,
"why": "Most \"port not open\" problems are one of four layers: nothing listening, listening only on 127.0.0.1, a host firewall, or the provider security group. Check from the inside out so each step rules out one layer.",
"steps": [
{
"command": "PORT=25774\nss -lntp | grep \":$PORT \"",
"risk": "safe"
},
{
"command": "curl -sS -o /dev/null -w \"%{http_code}\\n\" \"http://127.0.0.1:$PORT\"",
"risk": "safe"
},
{
"command": "docker ps --format 'table {{.Names}}\\t{{.Ports}}'",
"risk": "safe"
},
{
"command": "if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then firewall-cmd --list-all; elif command -v ufw >/dev/null 2>&1; then ufw status verbose; else echo \"no host firewall tool active\"; fi",
"risk": "safe"
}
]
}