A port is open when a program on your server is using it and no firewall blocks it. Your VPS can have two firewalls: one in the LumaDock client area, and one inside the operating system, usually ufw or firewalld. This article shows how to test a port and how to open it in both.
How to test a port
Run one of these commands on your own computer. Replace YOUR.VPS.IP with your server's IP address and 22 with the port you want to test.
Windows (PowerShell).
The last line says TcpTestSucceeded : True when the port is open.
Test-NetConnection YOUR.VPS.IP -Port 22
macOS and Linux (Terminal).
The output says succeeded when the port is open.
nc -vz -w 5 YOUR.VPS.IP 22
On macOS and Linux, Connection refused usually means no program on the server is using the port, although a firewall rule set to REJECT also refuses connections. A timeout usually means a firewall drops the traffic: the client-area firewall, the firewall inside the server or the network you are on. To check if your own network is the cause, try again from another network, such as a phone hotspot.
To see which programs use which ports, run this on the server, over SSH or in noVNC Console:
sudo ss -tulpn
0.0.0.0:PORT or [::]:PORT means the program accepts connections on all of the server's addresses, so it can be reached from outside when no firewall blocks the port. 127.0.0.1:PORT means only the server itself can reach it. If the port isn't listed, start the program.
Outgoing email on port 25 is filtered on new servers to prevent abuse. Who can ask for port 25 to be opened, and how, is explained in SMTP port 25 unblock requirements.
How to open a port in the client-area firewall
On the server's page, open Firewall under Service Management. A new VPS has no rules there.
With no rules, the client-area firewall blocks nothing. A rule that allows a port doesn't block anything else: traffic is blocked only by a rule set to DROP or REJECT. How to block everything except the ports you use is shown in Enable the firewall for your VPS.
Rules are checked from the top of the list, and each new rule is added at the top. If a rule that blocks everything is above your SSH or Remote Desktop rule (port 22 or your SSH port, or 3389 on Windows), you can't connect to the server. Switch that rule's Enable off or delete it to get back in.
Step 1: Open the form.
Click Create Firewall Rule.
Step 2: Fill in the rule.
Set Type to in, Action to ACCEPT and Protocol to 6 Transmission Control Protocol (TCP) or 17 User Datagram Protocol (UDP). Enter the port in Destination Port. To allow only yourself, put your own IP address in Source. Leave it empty to allow everyone.
Step 3: Switch the rule on and save.
A new rule starts switched off. Switch Enable on, write what the rule is for in Comment and click Confirm.
The rule appears in the list. The list doesn't show ports, so the comment is how you tell rules apart.
If a rule locks you out of SSH, the client area still works: switch the rule's Enable off or delete the rule. noVNC Console, the server's own screen in your browser, also keeps working.
How to open a port inside the server
ufw (Ubuntu, Debian).
Check the status first. If it says inactive, ufw blocks nothing.
sudo ufw status
If ufw is active, allow the port. For example, for a website on ports 80 and 443:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
Before you enable ufw, run sudo ufw allow 22/tcp (or your SSH port). If you enable ufw without that rule, SSH stops working.
Ports published by Docker bypass ufw. Limit them with the client-area firewall instead.
firewalld (AlmaLinux, Rocky Linux).
Allow the port and reload. Replace 8080 with your port:
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload
Check the result with sudo firewall-cmd --list-all.