Free tools Windows power users keep installed
One-click scans. No signup required.
To open SMTP port 25 on Ubuntu, you need all three of the following: an SMTP service such as Postfix listening on TCP port 25, a host firewall rule that permits the traffic, and an upstream provider or network policy that does not block it. Run sudo ufw allow 25/tcp only after confirming that a mail daemon is listening; a firewall rule by itself does not create an open port.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Check the result locally with sudo ss -utlnp | grep ':25', inspect UFW with sudo ufw status verbose, and test from another machine with nc -vz server.example.com 25 or telnet mail.example.com 25. A successful TCP connection proves reachability, not that DNS, TLS, authentication, relay policy, or mail reputation is correctly configured.
As an Amazon Associate I earn from qualifying purchases.
What an “open” port means on Ubuntu
Canonical’s Ubuntu security guidance defines an open port as a network port that is bound to a service and actively listening for incoming connections or packets. That definition separates three controls that are often confused:
- Application layer: An SMTP daemon, normally Postfix or another mail server, must bind to TCP port 25.
- Host firewall layer: UFW must allow the incoming packets to that port.
- Upstream network layer: Your hosting provider, cloud security group, data-center edge firewall, router, or ISP must permit SMTP traffic.
If any one layer rejects or drops the connection, port 25 appears closed from the Internet. Opening UFW cannot compensate for a service that is stopped, a daemon bound only to loopback, or a provider policy that blocks SMTP.
#1 Best Overall
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
Decide whether port 25 is the right port
Inbound Internet mail
Port 25 is the traditional server-to-server SMTP transport used when other mail systems deliver messages directly to your host. You need an Internet-reachable listener, correct DNS (including an MX record), and mail-server policies that prevent unauthorized relaying. This is the scenario in which an inbound firewall rule is normally required.
Outbound mail from applications
Allowing inbound port 25 does not make outbound mail work. Outbound SMTP is a separate traffic direction, and many providers impose independent limits or blocks. An application that only sends mail may be better served by an authenticated submission service or a managed relay, often on a submission port rather than port 25. Do not expose an unnecessary inbound listener merely to send notifications.
Recommended Free Tools
Private relay or restricted sender
If only one known server should deliver to this host, restrict the source instead of allowing the entire Internet. For example:
sudo ufw allow from 203.0.113.10 to any port 25 proto tcpThis permits TCP port 25 only from the stated address. Confirm that the sender’s address is stable and that every required relay is included before removing broader access.
Managed relay
A managed relay can eliminate the need for public inbound port 25 on your Ubuntu machine. The provider’s account, region, and network policy determine whether SMTP traffic is permitted, so check those controls separately from UFW. You still need to secure application credentials and configure the relay’s authentication requirements.
Check for an SMTP service before changing the firewall
Inspect listeners
Run this command on the Ubuntu server:
sudo ss -utlnp | grep ':25'The output should identify a process listening on TCP port 25. The address matters: 0.0.0.0:25 generally means all IPv4 interfaces, while 127.0.0.1:25 accepts only local connections. An IPv6 listener such as [::]:25 may be subject to a separate IPv6 firewall and provider policy.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteNo output means that no process is listening on the matching socket. In that case, adding a UFW rule will not make the port reachable.
Rank #2
- Cat 6 performance at a Cat5e price but with higher bandwidth
- High Performance Cat6, 30 AWG, RJ45 Ethernet Patch Cable provides universal connectivity for LAN network components such as PCs,computer servers,printers,routers,switch boxes,network media players,NAS,VoIP phones
- Jadaol cat6 standard cable support Cat8 and Cat7 network and provides performance of up to 250 MHz 10Gbps and is suitable for 10BASE-T, 100BASE-TX (Fast Ethernet), 1000BASE-T/1000BASE-TX (Gigabit Ethernet) and 10GBASE-T (10-Gigabit Ethernet)
- UTP(Unshielded Twisted Pair) patch cable with RJ45 gold-plated Connectors and are made of 100% bare copper wire, ensure minimal noise and interference
- The unique flat cable shape allows for a cleaner and safer installation. You can easily and seamlessly make the cable run along walls, follow edges & corners or even make it completely invisible by sliding it under a carpet.
Install an SMTP daemon when inbound mail is intended
Postfix is Ubuntu’s documented SMTP-server option. On a standard Ubuntu installation, the package can be installed with:
sudo apt update
sudo apt install postfixUse the package configuration prompts and then edit the resulting Postfix configuration for your hostname, domains, interfaces, relay policy, and authentication requirements. The exact values depend on whether the server is receiving mail for its own domains, relaying for authenticated applications, or forwarding through another service.
After configuration, restart or reload Postfix using the service action appropriate to the change, then check the listener again:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →sudo ss -utlnp | grep ':25'If Postfix is installed but absent from the output, inspect its service status and logs, correct the configuration error, and repeat the check. Opening the firewall before the daemon is ready only makes troubleshooting harder.
Confirm the bind address and protocol
Ensure the daemon is listening on the interface that should receive mail, not just on loopback. Decide separately whether IPv4, IPv6, or both are required. A DNS record that resolves to IPv6 will cause remote clients to try IPv6 first; an IPv6 listener or firewall rule that is missing can therefore look like an intermittent port-25 failure even when IPv4 works.
Allow TCP port 25 through UFW
Review the current firewall state
Before changing rules, display the effective policy:
sudo ufw status verbose
sudo ufw status numberedstatus verbose shows whether UFW is active and its default policies. status numbered gives rule numbers, which is useful when inserting or deleting a rule. If UFW is inactive, there may still be a provider firewall or another local firewall in the path; do not assume that activating UFW is harmless on a remote server.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- Designed for Outdoor & Direct Burial Installations – Heavy-duty double-shielded Cat8 Ethernet cable minimizes EMI/RFI interference and delivers stable long-distance performance. Waterproof, anti-corrosion PVC jacket allows safe direct burial and reliable use in outdoor or indoor environments.
- 26AWG for Stable High-Load Networks – Thicker 26AWG conductors provide faster, more stable data transmission than standard 32AWG cables. Ideal for high-performance home networks, gaming setups, smart homes, and data-intensive applications.
- F/FTP Shielding & Hyper-Speed Performance: Cat8 Ethernet cable constructed with 4 shielded foiled twisted pairs and 26AWG OFC conductors; supports bandwidth up to 2000 MHz and data transmission speeds up to 40 Gbps, effectively reducing signal interference and ensuring stable connections. Ideal for low-latency gaming, 4K/8K streaming, and high-speed internet connections.
- RJ45 Connectors & Wide Compatibility: Cat8 Ethernet cable with two shielded RJ45 connectors; compatible with networking switches, IP cameras, routers, Nintendo Switch, modems, PS3, PS4, Xbox, patch panels, servers, smart TVs, and more; works with Cat7, Cat6, Cat5e, and Cat5 devices
- Weatherproof & UV Resistant: Outdoor-rated Cat8 Ethernet cable with UV-resistant PVC jacket; withstands direct sunlight, extreme cold, humidity, and hot weather; anti-aging and durable; Includes 18-month support.
Allow port 25 for every source
For a server that must receive mail from arbitrary Internet senders, add a TCP rule:
sudo ufw allow 25/tcpUFW also accepts the service-name form:
sudo ufw allow smtpThe explicit protocol form is easier to audit because it states that only TCP is being opened. SMTP on port 25 is TCP; an unrelated UDP rule does not help remote mail delivery.
Prefer a source-restricted rule when possible
For a known relay or internal sender, use a source restriction:
sudo ufw allow from 203.0.113.10 to any port 25 proto tcpThis follows least privilege and reduces exposure to unsolicited scans and connection attempts. If several senders are legitimate, create one rule per approved source or use an appropriately controlled network range. Keep an inventory of those addresses so an old rule can be removed when a relay is retired.
Preview and verify the change
To inspect what UFW would do without applying it, run:
sudo ufw --dry-run allow 25/tcpThen apply the rule and verify the result:
sudo ufw allow 25/tcp
sudo ufw status verbose
sudo ufw status numberedOn a remote server, allow SSH before enabling UFW. Otherwise, enabling the firewall can terminate your administrative session and block subsequent access:
sudo ufw allow ssh
sudo ufw enableUse a second session or console access while enabling it, and confirm that the SSH rule covers the port and source range you actually use.
Rank #4
- Cat 8 Speed, Cat 5/5e Value Enjoy Cat 8 Ethernet cable performance at a Cat 5/5e-level value. With up to 40Gbps speed and 2000MHz bandwidth, this high speed internet cable delivers more bandwidth than standard Cat 5 and Cat 5e cables, helping support smooth gaming, streaming, video calls, large file transfers and everyday wired network use.
- 40Gbps Speed, Wide Compatibility This Cat 8 Ethernet cable supports up to 40Gbps data transfer and 2000MHz bandwidth for fast, reliable internet performance. Standard RJ45 connectors are backward compatible with Cat7, Cat6, Cat6a and Cat5e devices, including routers, modems, switches, gaming PCs, PS5, PS4, Xbox, smart TVs, laptops and printers.
- Stable U/FTP Shielding Each of the 4 twisted pairs is individually wrapped with aluminum foil to help reduce crosstalk, noise, and signal interference. Combined with RJ45 connectors on both ends, the U/FTP design helps maintain cleaner signal transmission for a stable and reliable wired network connection.
- Nylon Braided Durability The nylon braided jacket adds everyday durability while keeping the cable flexible and easy to route. Reinforced construction helps the cord handle bending, pulling and frequent plugging, making it a reliable choice for desks, gaming rooms, home offices and long-term network setups.
- 50ft Reach for More Setups The 50 ft length makes it easier to connect devices across rooms, along walls, under desks or around corners. Great for router-to-PC connections, modem-to-TV setups, gaming consoles, workstations, printers and other home network equipment that needs a longer Ethernet cable.
Remove the rule when it is no longer needed
Close an unneeded public rule with:
sudo ufw delete allow 25/tcpIf you created a source-specific rule, delete that exact rule instead. Check the numbered list first when multiple similar entries exist, so you remove the intended policy rather than a different SMTP exception.
Check provider and network controls
Cloud and hosting platforms can filter SMTP independently of Ubuntu. Review the instance security group, virtual network ACL, edge firewall, and any account-level “SMTP block” or abuse-prevention setting. Policies can differ by provider, account, region, and whether the address is new or previously flagged. A host-level rule cannot override a packet drop upstream.
For a private server behind a router, forward TCP port 25 to the correct internal address and verify that the public DNS name resolves to the router’s current public address. Avoid exposing an administrative or unrelated machine by forwarding the port to the wrong internal host. If a corporate firewall or ISP blocks outbound or inbound SMTP, request an exception or use an authenticated relay rather than repeatedly changing UFW.
Test port 25 locally and from outside
Local listener test
First prove that the service is listening:
sudo ss -utlnp | grep ':25'This is a socket check, not an end-to-end test. It does not confirm that a remote packet can reach the server or that Postfix will accept a message.
Remote TCP reachability test
From a different machine and network, run:
nc -vz server.example.com 25Netcat should report a successful connection when the TCP handshake completes. The documented Telnet-style test is:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
telnet mail.example.com 25A functioning SMTP service commonly returns a greeting beginning with a 220 status code. You can type EHLO test.example to see advertised capabilities and then end the session with QUIT. Do not send real mail during a connectivity test.
Interpret what the test proves
- Connection refused: The host is reachable, but no service is accepting the connection on that address and port, or a firewall is actively rejecting it.
- Timeout: A provider firewall, security group, router, host firewall, or wrong address may be silently dropping packets.
- Successful handshake: The route, TCP port, and listener are reachable. It does not validate MX records, reverse DNS, TLS certificates, authentication, relay restrictions, spam reputation, or final delivery.
Run tests against the hostname and the server’s public IP when diagnosing DNS. If the hostname resolves to multiple addresses, test each address or temporarily inspect DNS answers so an unhealthy IPv6 path is not mistaken for a general outage.
Best Value
- [Flat Design, Zero Cable Clutter] - Lies perfectly flat against walls, under rugs, along baseboards, and through tight spaces without kinks, tangles, or messy coils. Customers praise it for effortless installation and clean cable management that blends into any room.
- [REINFORCED BRAIDED CONSTRUCTION FOR LONG‑LASTING PERFORMANCE] - Premium cotton braided jacket paired with reinforced RJ45 connectors delivers outstanding durability, rigorously tested for over 15,000 bend cycles. Many customers describe this ethernet cable as rock‑solid and well‑crafted, ideal for long‑term daily use with no worries about premature wear‑and‑tear or connection failure
- [10GBPS SPEED & 600MHZ BANDWIDTH — GAMING, STREAMING & FIBER READY] - Delivers 10Gbps data transfer rate with 600MHz bandwidth for PS5, Xbox, 4K streaming, and fiber internet. Customers report stable performance and fast speeds. Backward compatible with Cat 6 and Cat 5e devices
- [STP SHIELDING & GOLD-PLATED RJ45 — MINIMIZES EMI/RFI INTERFERENCE] - 100% bare copper STP shielding helps protect signal integrity when routed near power cords. Gold-plated RJ45 connectors resist corrosion. Compatible with 2.5GB network card
- [Works with Everything — Router, Modem, PS5, Xbox, PC, Smart TV, Printer More ] - Full backward compatibility with Cat7, Cat6, Cat6a, and Cat5e devices means this one cable works with all your home or office equipment today, and future upgrades tomorrow. Works with 10/100/1000/10G/40G BASE-T speeds. Includes 36-month warranty with free replacement support
Troubleshoot “port 25 is still closed”
No listener is shown by ss
Start with the mail service rather than UFW. Check whether Postfix is installed, enabled, and running; inspect its configuration for syntax errors and verify that another program has not claimed the port. Correct the service problem, reload it, and repeat the socket check.
The listener is bound only to localhost
A listener on 127.0.0.1:25 accepts local applications but cannot receive Internet traffic. Change the SMTP daemon’s interface setting to include the intended server address, reload the daemon, and confirm the new address with ss. Do not bind publicly until relay controls and authentication are configured.
UFW is inactive or the rule is missing
Use sudo ufw status verbose and sudo ufw status numbered. If UFW is inactive, investigate other local or upstream controls instead of assuming that an allow rule has effect. If the rule is absent, add it, then verify that the default incoming policy and any more-specific deny rule do not override the expected result.
The provider is filtering SMTP
If the local listener and UFW rule are correct but an external test times out, inspect the provider’s security group and account restrictions. Some hosts require a support request, a new public address, or use of a relay. Test from a second external network to rule out a client-side egress block.
IPv4 works but IPv6 fails
Compare DNS records with the addresses shown by the listener. Confirm that Postfix is bound to IPv6 if you publish an AAAA record and that IPv6 firewall and provider policies permit TCP 25. As a temporary diagnostic, test the IPv4 address explicitly; do not leave misleading DNS records in place.
A DNS name reaches the wrong machine
Check the hostname’s A and AAAA records and compare them with the server’s actual public addresses. A stale record, NAT mapping, or load-balancer rule can send the test to a different host whose port 25 is closed. Correct DNS or forwarding before changing firewall rules.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Secure an SMTP listener before exposing it
Ubuntu warns that open ports on untrusted networks increase risk when the listening service is vulnerable or misconfigured. Port 25 receives connections from arbitrary Internet systems, so treat exposure as a mail-security project, not a single firewall command.
- Configure Postfix relay restrictions so unauthenticated Internet clients cannot use the server to deliver mail to unrelated domains.
- Enable authentication for clients that are allowed to relay, and protect credentials according to your organization’s security policy.
- Apply security updates and monitor mail logs for repeated failures, unusual volume, and signs of abuse.
- Use encrypted transport where your mail design requires it, while recognizing that encryption support does not replace relay authorization.
- Close port 25 when the server no longer receives mail, using the UFW deletion command and any provider-firewall change.
The Ubuntu Postfix guidance notes that the Ubuntu package uses a chroot by default as a security measure. Preserve that packaging behavior unless you understand the operational and security consequences of changing it.
Quick Recap
Choose the implementation that matches your traffic
| Approach | Inbound exposure | Firewall policy | Best fit | Main trade-off |
|---|---|---|---|---|
| Public Postfix server | Internet clients connect to TCP 25 | Allow TCP 25 from any source at both host and provider layers | Direct delivery for domains hosted on the server | Highest exposure; requires DNS, anti-abuse controls, monitoring, and reputation management |
| Source-restricted Postfix | Only approved senders connect | Allow TCP 25 from named addresses or networks | Private relay or controlled system-to-system delivery | Address changes require rule maintenance; unknown Internet senders cannot connect |
| Authenticated submission | Port 25 may remain closed to the Internet | Permit only the submission service and trusted client sources | Applications and users sending through a relay | Does not provide direct inbound delivery for your domain |
| Managed relay | No public listener required on the Ubuntu host | Permit outbound connections required by the relay | Sites that want external handling of delivery and reputation | Depends on provider limits, credentials, policy, and availability |
| Provider firewall plus UFW | Controlled at two network layers | Keep host and upstream rules consistent and auditable | Cloud deployments needing defense in depth | A mismatch at either layer causes failed connections and can complicate diagnosis |
Operational checklist
- Define whether you need inbound Internet delivery, a private relay, application submission, or only outbound mail.
- Install and configure an SMTP daemon if inbound delivery is required.
- Run
sudo ss -utlnp | grep ':25'and confirm the expected address, protocol, and process. - Inspect UFW with
sudo ufw status verboseandsudo ufw status numbered. - Preview a rule with
sudo ufw --dry-run allow 25/tcpwhen you need to audit the change first. - Allow TCP 25 publicly or restrict it to approved sources with a source-specific rule.
- On a remote server, permit SSH before enabling UFW.
- Open the equivalent port in the provider firewall or security group, and check account-level SMTP restrictions.
- Test from another network with
nc -vz server.example.com 25ortelnet mail.example.com 25. - Validate DNS, TLS, authentication, relay restrictions, logging, and mail reputation separately from the TCP test.
- Delete the UFW rule and upstream exception when port 25 is no longer part of the design.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
