Port inspection has two layers: what ports the firewall rules allow, and what sockets the system is listening on. This guide covers four tools—firewalld, ufw, iptables, and ss—with commands verified on WSL Ubuntu 24.04.
先用 ss 看监听 socket
ss -tulnpss is the modern replacement for netstat; it reads kernel netlink directly and is faster.-t show TCP，-u show UDP，-l listening state only，-n don’t resolve service names，-p show process name。WSL 实测：default listening ports include systemd-resolve on 53 and chrony on 323; output is stable [1]。
ss -tulnp | grep ':22'Filtering by port with grep is also convenient; grep runs client-side and does not affect kernel statistics.
firewalld：list-ports / list-all
firewall-cmd --list-ports
firewall-cmd --list-all--list-ports only outputs the port list in 端口/协议；--list-all also shows zones, services, protocols, and rich rules for fuller context [2]。Runtime and permanent configs are separate; after changing rules you need --permanent to write to disk [3]。
WSL test: after a fresh firewalld install the zone is public, with ssh and dhcpv6-client allowed by default;--list-ports starts empty; after adding 8080/tcp it immediately returns 8080/tcp; deleting it restores the empty state.
ufw：status verbose
ufw status verboseufw is the simplified front-end default on Ubuntu/Debian;status shows active status,verbose lists the number, direction, action, and port for every rule [4]。numbered the numbered parameter shows rule numbers for easy ufw delete <编号> rollback [6]。
WSL test: status is inactive after a fresh install;ufw allow 8080/tcp checking again shows 8080/tcp ALLOW; deleting restores inactive.
iptables：直接查链
iptables -L -n
iptables -L INPUT -n --line-numbersiptables operates on four netfilter tables; filter is the most commonly used.-L lists chains,-n shows numeric ports,--line-numbers shows rule numbers for easy deletion [5]。When the default policy is ACCEPT, an empty chain looks like this:
Chain INPUT (policy ACCEPT)
target prot opt source destinationWSL test: all three default chains are empty; inserting -p tcp --dport 9090 -j ACCEPT 后，INPUT 链出现规则 1; deleting it restores the empty state.
rollback与排错
| Symptom | 原因 | 处理 |
|---|---|---|
firewall-cmd 报错 not running |
service not started | systemctl start firewalld |
ufw status 显示 inactive |
rules not enabled | ufw enable |
ss 看不到某端口 |
process not listening or bound to 127.0.0.1 | 用 ss -tlnp 与 grep <端口> 确认 |
iptables 规则不生效 |
inserted into a non-default table | 加 -t filter 显式指定 |
Use firewalld or ufw on desktops and dev machines; use ss directly on server scripts and container environments; reach for iptables when you need fine-grained control across NAT, mangle, and other tables.
limitations
- Tests were run on WSL Ubuntu 24.04; RPM-based firewalld versions and zone behavior may differ.
- On some newer kernels iptables is replaced by an nftables backend; syntax is compatible but the underlying implementation differs.
- Container environments (Docker) insert custom chains,
iptables -Lso the output may have more entries than the host.
—
Not fully verified: — The netstat command, firewalld rich rules, and ufw advanced matching were checked against documentation only and not executed.
参考资料
- [1] ss(8) – Linux manual page(ss)
- [2] firewall-cmd man page(fw-cmd)
- [3] Open a Port or Service – Firewalld HowTo(fw-howto)
- [4] ufw(8) — Debian manpages(ufw)
- [5] iptables(8) – Linux manual page(ipt)
- [6] UFW – Ubuntu Community Help Wiki(ubu-ufw)
Key commands verified on WSL Ubuntu 24.04; unverified items noted in-text.
