Both are fine. Ufw has a set of applications that are defined in terms of what ports they need for convenience. You wouldn’t have to know that 3389 is for RDP, you could just allow RDP. Ufw ultimately modifies the iptables, it is just another interface for interacting with it.

A big thing the other comments are missing is that just running the iptables rule only works for the current boot. You need something to rerun it every restart

ufw is a front end to make it easier to use them

If you want/need more control, you should look into /etc/iptables/rules.d config files

Edit: or depending on what your distro already has, the firewalld comment makes a lot of sense. E.g. that’s Fedora’s default front end

You can also open a single port with UFW.

Opening single ports is safer from a technical standpoint.

From a practical standpoint, your personal laptop probably doesn’t need that much security. You’re probably already behind a firewall anyway, and you’re not openly reachable 24/7.

I’d go as far as say that you probably don’t even need to turn on a firewall at Unless you don’t use a recently secure password, I guess, then you may need to firewall out SSH and RDP.

There’s an advantage to the “block outgoing traffic from unknown applications” kind of firewall, but UFW does the opposite and iptables (or nftables in more recent distros) is a pain. If you want that, there are tools out there that can do that.

Having an incoming firewall at all is pretty good for security, no need to make your life unnecessarily difficult with complex rules and conditions. Especially if all that security makes you turn off the firewall entirely every time you need to print or connect to a different WiFi access point.

ufw or firewalld have presets and will automatically open the right ports and traffic types.

Also these are different programs.

sudo ufw allow 3389

How’s that? Check the docs on ufw for more