fren
Log In

List open ports on a VPS

2 min read07 November 2026

"Open port" covers two realities: a process listens on the machine, and that port is reachable from outside. A service can listen on 127.0.0.1 without being exposed, or listen on 0.0.0.0 while being blocked by the firewall. Auditing a VPS means checking both sides.

See what listens

Bash
sudo ss -tulpn

The options read as follows: -t TCP, -u UDP, -l listening sockets, -p process, -n numeric ports. Without sudo, process names for other users are hidden.

The local address column shows the scope:

  • 127.0.0.1:5432: reachable only from the machine.
  • 0.0.0.0:80: all IPv4 interfaces.
  • [::]:80: all IPv6 interfaces, and often IPv4 depending on configuration.
  • [::1]:6379: IPv6 loopback only.

To target one port:

Bash
sudo ss -tlnp 'sport = :80'
sudo ss -tunlp
ss -t state established

netstat -tulpn gives a similar result if net-tools is installed, but ss is the current tool. sudo lsof -i -P -n helps link a port to a process and its files.

Tell listening from reachable

A listening port is not necessarily reachable. Check the local firewall:

Bash
sudo ufw status verbose
sudo nft list ruleset

Then test from a machine other than the VPS, never from the VPS itself, because a local connection bypasses external filtering:

Bash
nc -6 -vz VOTRE_IPV6 80
curl -6 -I http://VOTRE_IPV6

An nmap scan is acceptable only against your own VPS and in moderation:

Bash
nmap -6 -Pn -p 22,80,443 VOTRE_IPV6

Do not widen the scan to ranges you do not own. Also watch Docker: a port published with -p can bypass UFW and be exposed despite a deny policy, because Docker inserts its own rules.

Close what is unnecessary

For each port, identify the service:

Bash
sudo ss -tlnp 'sport = :3000'
ps -fp PID
systemctl status service-name

If the service is not needed, stop it and disable it at boot. If it must stay local, configure it to listen on 127.0.0.1 rather than 0.0.0.0. Finally apply a default deny policy and open only what is required:

Bash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80,443/tcp

Do not kill an unknown process before identifying it: it may be a system component or a service your application depends on.

Verify

Bash
sudo ss -tulpn
sudo ufw status

After closing, the port must disappear from ss and the external test must fail. Run the check again after a reboot: an enabled service can reopen a port you thought was closed. Keep SSH and the noVNC console reachable throughout any firewall change.

Advertisement

Was this article helpful?

Read next