How to List and Delete UFW Firewall Rules

UFW (Uncomplicated Firewall) is a user-friendly frontend for managing Linux firewall (netfilter) rules. It is the default firewall configuration tool for Ubuntu and is also available on other Linux distributions such as Debian .

This guide explains how to list and delete UFW firewall rules using the command line.

Quick Reference #

For a printable quick reference, see the UFW cheatsheet .

Prerequisites #

The user running UFW commands must be a sudo user.

Listing UFW Rules #

To check the status of UFW and list all active rules, run:

sudo ufw status

If UFW is disabled, the output looks like this:

Status: inactive

If UFW is active, the output prints all active firewall rules:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)

Verbose Output #

To display additional information such as logging level, default policies, and new profiles, use status verbose:

sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)

Numbered Output #

Use status numbered to display the order and ID number of each rule. This is useful when you need to delete a specific rule by its number:

sudo ufw status numbered

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    Anywhere
[ 4] 8069/tcp                   ALLOW IN    Anywhere

Showing Rules with ufw show #

The status command reports the running firewall. The show command prints reports about the firewall configuration itself. The most useful of these is added, which lists equivalent commands for your saved rules:

sudo ufw show added

Added user rules (see 'ufw status' for running firewall):
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp

Each rule line is a complete command, so you can copy one to recreate the rule on another machine. UFW normalizes rules, so the commands may look different from those you originally typed. It also does not preserve the original command ordering and uses an equivalent ordering that lists IPv6-only rules after other rules.

This report reads the rules you added rather than the live netfilter tables, which means it still lists your rules when UFW is inactive and ufw status reports only Status: inactive.

The show command accepts one report name:

• added - Equivalent commands for your saved rules
• listening - Ports in the listening state and the rules that apply to them
• raw - The complete firewall in raw iptables format
• builtins - The built-in chains
• before-rules - Rules applied before the user rules
• user-rules - The user rules
• after-rules - Rules applied after the user rules
• logging-rules - The logging rules

To find out which services are exposed and how the firewall treats them, use the listening report:

sudo ufw show listening

It prints each listening port with the interface address and the executable behind it, followed by any UFW rule that matches. Every report except added and listening is raw iptables output, so it reflects the running firewall rather than your saved configuration.

Deleting UFW Rules #

UFW has no remove subcommand. The command is ufw delete, and there are two ways to use it:

• By rule number: Easier when you have many rules. List the numbered rules and specify which number to delete.
• By specification: Specify the full rule definition to remove it.

Delete by Rule Number #

First, list the rules with their numbers:

sudo ufw status numbered

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 80/tcp                     ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    Anywhere
[ 4] 8069/tcp                   ALLOW IN    Anywhere

To delete rule number 4 (port 8069), run:

sudo ufw delete 4

UFW asks for confirmation before deleting:

Deleting:
 allow 8069/tcp
Proceed with operation (y|n)? y
Rule deleted

Type y and press Enter to confirm. Each time you remove a rule, the remaining rule numbers shift. Always list the rules again before deleting another one.

With IPv6 enabled, a generic rule can have separate IPv4 and IPv6 entries. Deleting by number removes only the selected entry. To remove both entries with one command, delete the generic rule by specification.

If you need a non-interactive deletion (for scripts), use:

sudo ufw --force delete 4

Delete by Specification #

You can also delete a rule by specifying its full definition. This method does not require listing numbered rules first.

For example, if you previously added a rule to allow port 2222:

sudo ufw allow 2222

You can delete it by repeating the rule after ufw delete:

sudo ufw delete allow 2222

This also works with more specific rules. To delete a rule that allows TCP traffic on port 80 from a specific subnet:

sudo ufw delete allow from 192.168.1.0/24 to any port 80 proto tcp

Reset UFW and Remove All Rules #

Resetting UFW disables the firewall and removes all active rules. This is useful when you want to revert all changes and start with a clean configuration:

sudo ufw reset

UFW creates backup files of the current rules before resetting. The backup file paths are displayed in the output.

Troubleshooting #

Could not delete non-existent rule
UFW could not find a matching rule for the IP version shown in the message. Run sudo ufw show added to check the saved rule commands and repeat the matching specification after ufw delete. With IPv6 enabled, deleting a generic rule attempts both IPv4 and IPv6 deletion, so a successful IPv4 deletion can be followed by Could not delete non-existent rule (v6) if the IPv6 counterpart is missing.

ERROR: Could not find rule 'N'
The number you passed to ufw delete is out of range. Rules are renumbered after every deletion, so list them again with sudo ufw status numbered before retrying.

ERROR: Could not find a profile matching 'NAME'
The application profile name is wrong. This error comes from the profile lookup rather than the rule list. Run sudo ufw app list to see the installed profile names and retry with the exact name.

Rule numbers changed after deletion
UFW renumbers all rules after each deletion. Always run sudo ufw status numbered again before deleting the next rule.

Locked out of SSH after deleting a rule
If you accidentally removed the SSH rule, you need console or out-of-band access to the server. Once connected, re-enable SSH access with sudo ufw allow 22/tcp and then sudo ufw enable.

ufw: command not found
UFW is not installed. Install it with sudo apt install ufw on Ubuntu, Debian, and Derivatives, or sudo dnf install ufw on Fedora. RHEL-compatible systems commonly use firewalld; if you choose UFW there, you may need to enable EPEL or another suitable package source first.

FAQ #

How do I list only IPv4 or IPv6 rules?
UFW does not have a built-in filter for IP version. You can pipe the output to grep: use sudo ufw status | grep -v '(v6)' to show only IPv4 rules, or sudo ufw status | grep '(v6)' to show only IPv6 rules.

Can I delete multiple rules at once?
UFW deletes one rule per command. When removing several rules by number, delete them in descending order so that renumbering does not shift the rules you have not reached yet. To clear everything, use sudo ufw reset.

What happens to existing connections when I delete a rule?
With the default UFW rules, already established connections are not immediately dropped when you delete a rule. New connections are evaluated against the remaining rules and the default policy. Deleting an allow rule may block new connections, while deleting a deny rule may permit them.

How do I insert a rule at a specific position?
Use sudo ufw insert NUMBER RULE. For example, sudo ufw insert 1 allow from 10.0.0.0/8 adds the rule at position 1, before all other rules.

What is the difference between ufw disable and ufw reset?
ufw disable turns off the firewall but keeps all rules intact. ufw reset disables the firewall and deletes all rules, restoring the default configuration.

Conclusion #

You can list UFW firewall rules with sudo ufw status numbered and delete them by number or by specification. Always verify the numbered rule list before deleting, and take care not to remove your SSH access rule on remote servers.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page