---
type: Setup Guide
title: "SNMP Firewall Rules: iptables, ufw & firewalld (Port 161)"
description: "Allow SNMP UDP 161 only from your manager's IP using iptables, ufw, or firewalld, and open 162 on the trap receiver."
resource: "https://snmp-monitoring.info/setup/firewall/"
tags: [setup]
timestamp: 2026-07-11T00:00:00Z
---

# SNMP Firewall Rules: iptables, ufw & firewalld (Port 161)

Allow SNMP UDP 161 only from your manager's IP using iptables, ufw, or firewalld, and open 162 on the trap receiver.

## Related concepts

- Up: [SNMP Setup & Configuration: Install, Secure & Test](/setup/index.md)

## Frequently asked questions

### How do I open port 161 in the firewall?

Add a source-scoped UDP rule. ufw: ufw allow from <manager-ip> to any port 161 proto udp. iptables: iptables -A INPUT -p udp -s <manager-ip> --dport 161 -j ACCEPT. firewalld: a rich rule with source address=<manager-ip> port port=161 protocol=udp accept, then --reload. Always restrict the source.

### Should I allow SNMP from anywhere?

No — never open UDP 161 to 0.0.0.0/0. An internet-exposed agent is found by scanners quickly, and on v1/v2c the cleartext community offers little protection. Scope every rule to the specific IP or CIDR of your manager(s), and combine it with an OID allowlist and, ideally, SNMPv3.

### What port do SNMP traps use?

Traps use UDP 162, and the rule goes on the receiver (your manager), not the agent. Open UDP 162 inbound on the trap receiver, scoped to the source addresses of the devices that send traps. The agent itself only needs 161 inbound for polling.

### iptables, ufw, or firewalld — which for SNMP?

Use whichever your distro ships: ufw on Ubuntu/Debian, firewalld on the RHEL family, and raw iptables where neither front-end is present. The rule is identical in effect — allow UDP 161 from your manager's source IP and drop the rest. The front-end only changes the syntax, not the principle.

## Source

Concept generated from https://snmp-monitoring.info/setup/firewall/ — the SNMP Monitoring vendor-neutral knowledge base. Content is limited to what that page states (no external claims added here).